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Message from the FBI Director 


Every day in America, acts of planned violence are carried out against innocent people simply 
going about their lives. The mass shootings we see so frequently today are a dramatic example. | know 
many Americans feel that no place is safe — schools, places of worship, worksites, or public gatherings. 
Fear like that can become disabling, and that is no way to live. 


The FBI is committed to making our country safer by finding ways to reduce attacks like mass 
shootings, and other forms of targeted violence such as stalking, terrorism, or ambush attacks on law 
enforcement. For years, the FBI and other law enforcement agencies, academic researchers, mental 
health experts, and the news media have studied this problem. In 2015, the FBI’s Behavioral Analysis 
Unit brought together a multidisciplinary group of experts to collaborate on solutions. 


This monograph represents the collective experiences and insights of the Behavioral Analysis 
Unit and these experts. We hope it serves as a practical guide to threat assessment and management. It 
is intended for novice and experienced professionals alike, and | believe it offers something for all of us 
who are paid to investigate and stop such acts of violence. The best way to counter any threat is to 
combine knowledge, experience, and cooperation with our partners. We must all work as a team. 


| am grateful to all those who helped create this guide for their time, their expertise, and their 
commitment to public safety. | hope this helps you better understand and ultimately prevent targeted 
acts of violence in your communities. Thank you for making the choice to do good for a living and for 
serving the people of this great country. 


James B. Comey 
Director 
Federal Bureau of Investigation 


viii 


Foreword 


The FBI’s National Center for the Analysis of Violent Crime (NCAVC) is part of the Critical Incident 
Response Group (CIRG) located at the FBI Academy at Quantico, Virginia, and consists of FBI Special 
Agents and professional support staff, and representatives from other federal agencies and 
departments. The NCAVC provides operational support in the areas of counterterrorism, 
counterintelligence, cyber crimes, crimes against children, crimes against adults, and threat assessment. 
The Behavioral Threat Assessment Center (BTAC) is the NCAVC’s center of expertise for threat 
assessment and management. Cases accepted by the BTAC often include post-incident analysis of 
completed attacks; “person of concern” cases in school, workplace and other contexts; stalking; threats 
and extortion; and other forms of planned violence. 


The BTAC reviews cases from behavioral, investigative, and legal perspectives, offering a range 
of services for law enforcement agencies around the country and the world. Services include behavioral 
threat assessments and management strategies, interview strategies, prosecutorial strategies, on-site 
deployments to assist with investigations of completed attacks, and more. Products generated by the 
BTAC serve as operational tools for client law enforcement agencies to help them effectively prioritize 
resources and plan investigative and violence prevention strategies. The BTAC also conducts research 
into targeted violence from a law enforcement perspective in an effort to gain insight into criminal 
thought processes, motivations, and behaviors. Results of this research are shared with law 
enforcement and academic communities through publications, presentations, and training, as well as 
through application of knowledge to the investigative and operational functions of the BTAC. 


Assistance of the BTAC can be requested by law enforcement agencies. They may request it 
through one of the FBI’s 56 domestic FBI field offices or 64 legal attaché offices in US embassies around 
the world, in furtherance of their own investigations or in responding to a request by a community, 
school, employer, or other entity. One goal of this guide is to educate and empower communities to 
address some of these issues independently. 


The BTAC, working with experts in targeted violence and threat assessment and looking at the 
active shooter problem from a law enforcement and behavioral perspective, wanted to examine 
promising strategies for preventing these attacks. From July 26 to 28, 2015, the BTAC hosted a 
symposium at the University of Virginia, Charlottesville, Virginia. A collaborative group consisting of 
representatives from law enforcement, academia, law, and mental health, along with members of the 
BTAC and the NCAVC, came together to share expertise and experiences on this important issue. 


The agenda included presentations and working group sessions on relevant topics in the field of 
threat management. This monograph is the culmination of those efforts, outlining consensus views and 
offering BTAC experiences with recommended practices in a field that is evolving. It is hoped this 
monograph will serve as a useful and practical guide for understanding and implementing threat 
assessment and management at all levels. 
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Introduction 

Traditional law enforcement techniques historically have focused on the apprehension and 
prosecution of violent offenders after violent crimes are committed. When police are given information 
that someone may potentially commit a crime or become violent in the future, their responsibilities, 
authorities, and available investigative tools are suddenly less clear. This guide is about threat 
assessment and management, or stated another way, how law enforcement officers and others may 
identify, assess, and manage the risk of future, planned violence. This task is a complex and nuanced 
one. Published research about intended violence and its perpetrators, along with knowledge and 
experience derived from previous cases, are applied to the facts and circumstances of each case. In 
other words, there is a lot to think about. 


The FBI Behavioral Analysis Unit (BAU) held a symposium in mid-2015, bringing together 
academic researchers, mental health experts, and law enforcement practitioners of threat assessment 
to discuss the active shooter phenomenon. Specifically, symposium participants focused on prevention 
strategies with regard to this crime problem. By far the most valuable prevention strategy identified 
was the threat assessment and management team. The good news is that every organization and 
community has the potential to stand up or access such a team. The intent of this publication is, 
therefore, to provide desperately needed guidance on making this a reality for every community based 
upon a consensus of recommendations in an evolving field. Recommendations are offered about this 
process in very practical terms. It is not intended as an academic textbook but rather as a hands-on 
guide for novice and experienced threat assessment practitioners alike. 


The first and most fundamental potential barrier to engagement is lack of knowledge- 
knowledge about threat assessment and management itself, about risk factors and warning signs, about 
what goes into managing potential threats. This knowledge is a key to implementing viable strategies to 
reduce targeted violence. Without it, prevention efforts are far less effective because they may then be 
guided by assumption and fear of the unknown, rather than knowledge and experience. This guide 
provides some of the information needed for creating teams and engaging in the business of threat 
assessment and management. It is derived from published research and the collective experience of the 
BAU and other experts. 


This guide first addresses some important awareness aspects of the active shooter problem, not 
the least of which is the term “active shooter.” The content of this publication does not begin and end 
with active shooters, but instead applies to targeted violence generally. However, it does not specifically 
address potential acts of terrorism, or threat assessment for violence perpetrated primarily in 
furtherance of a political, religious, or other extremist cause or ideology. Planned violence, threat 
assessments, violence and mental health, and barriers to successful prevention efforts are also 
discussed. The guide then offers specific and actionable information on identifying, assessing, and 
managing persons who pose a true concern for planned, targeted violence. Guidance about setting up 
and running a threat management team is offered. Sample tools are provided in the appendices. 


Additionally, this guide is context-neutral, and can be applied to educational, workplace, and other 
situations. 


Prevention is not and cannot be a passive process. It requires a strong and overt commitment 
by organizations and communities to prioritizing public safety and caretaking for those in need. This 
is manifested by adoption of policies and programs to support targeted violence prevention efforts, 
establishment of threat assessment and management teams, and education to underscore the 
importance of these processes and to promote acceptance and engagement by all. 


Chapter 1 Awareness: Initial Step Toward Change 


Violence is gender neutral 

Those responsible for threat assessment and management should recognize that both male and 
female persons of concern for targeted violence will come to their attention. There may be a tendency 
for stakeholders to view the potential threat posed by females as less worrisome, e.g. dismissing 
threatening writings by females as mere fantasy or attention-seeking material. The BAU strongly 
cautions against this approach, and recommends safety stakeholders not dismiss female persons of 
concern as nonthreatening based upon statistics supporting the idea that males are more likely to 
offend in this way. Targeted violence is a highly individualized crime based upon highly individualized 
and unique motivators. 


For ease of reading, however, only male gender pronouns are used in this publication in 
reference to single individuals. 


Diminishing the violent offender 

While it can be difficult or even impossible to truly understand, for some people there is an aura 
of power or cultural fascination surrounding shooting attacks. It attracts and encourages certain 
troubled individuals, helping to propel them along their paths toward intended violence. This aura can 
be projected by an offender in a pre-recorded video manifesto or during an attack, or it may be an 
interpretation by the reader of an online statement posted immediately after an incident. The 
dominance of 24/7 media coverage, networks and internet sites competing with each other for viewers, 
and even our own fascination as a society perpetuates this and allows it to grow and evolve. 


Before case-specific prevention efforts even begin, the problem of glorification of these events 
should be addressed. First and foremost, the words society as a whole uses to describe both the 
phenomenon and the attackers are fostering this mystique. Terms like “active shooter,” “lone wolf,” or 
any others that romanticize and idealize these offenders, should be deemphasized. Such words and 
phrases project power and sensationalize predatory violence. Instead, describing an attack as an 
incident or shooting incident, and the attacker as an assailant or offender, is strongly recommended as a 
means of denying legacy establishment to these violent criminals. Extensive media coverage featuring 
the offenders’ names, photos and life stories only cements the legacies they seek to achieve. It may 
never be possible to pinpoint primary influences on individual decisions to attack, particularly in cases 
where an offender does not survive the incident. Highly personal factors are dominant motivators; 
however, some inspiration may also derive from intensive and available coverage of past acts and actors. 


A shooting incident, once sensationalized in the media, can live on for years in full color and 
sound, at a keystroke. A change in the way these events are reported and talked about may diminish 


this phenomenon. The term active shooter? should be dropped from our cultural narrative. News 
media should refrain from naming the assailants, from posting their photographs, videos and 
communications, and from publishing detailed investigations into their lives and motives. 


This guide will adopt that posture and refrain from using sensationalizing descriptors. 


These offenders don’t “snap”—they decide 

Violence can be categorized in one of two ways: predatory/planned or impulsive/reactive. 
Predatory/planned violence is premeditated and serves some purpose for those who plan and conduct 
violent attacks. Impulsive/reactive violence, on the other hand, is emotional and impromptu; it is 
frequently a defensive behavior in response to a perceived imminent threat. These two types of 
violence are distinctly different. Clinical and forensic data on adult and adolescent mass murder, the 
type of violence this guide is concerned with, will reveal that virtually all of these acts are 
premeditated, rather than impulsive, violence. Two obvious signs indicate this is so: the planning and 
preparation for days, weeks, or months, sometimes recorded by these offenders and often observed by 
others, and the utter lack of emotion witnessed by survivors while the perpetrators committed their 
crimes.* 


Targeted mass attacks are just that—“targeted." Forethought and planning go into the attack. 
These are not spontaneous, emotion-driven, impulsive crimes emanating from a person's immediate 
anger or fear. In fact there is no evidence in the research to date that “snap” mass murders occur at all.’ 
The perpetrators often have a grievance and they take time to consider, plan, and prepare their attack. 
This is one advantage that threat assessment teams have—preparing to engage in violence almost 
always requires time and action, which in turn allows for opportunities for bystander observation and 
reporting. This will be discussed further below. 


Threat assessment 

Threat assessment is a systematic, fact-based method of investigation and examination that 
blends the collection and analysis of multiple sources of information with published research and 
practitioner experience, focusing on an individual’s patterns of thinking and behavior to determine 
whether, and to what extent, a person of concern is moving toward an attack. A threat assessment is 
not a final product, but the beginning of the management process. It guides a course of action to 
mitigate a threat of potential violence; merely identifying that someone is of moderate or higher 
concern, without developing a management strategy, does not complete this process and is not 
recommended. 


When a person of concern has been brought to the attention of safety stakeholders, it is 
essential to engage as early as possible in the assessment and management process. By the time crisis- 
stage management is reached, likely solutions run the risk of being “knee jerk” rather than measured 


* The BAU acknowledges this term has a valid, descriptive meaning for responding law enforcement officers and 
safety personnel. It lets responders know that an offender may be a continuing threat of gun violence, which 
activates a particularized response and set of tactics by law enforcement. The BAU understands the value in 
retaining this term as an internal, law enforcement phrase for operational use. 


and thoughtful, with past, present and future in mind. By engaging in the assessment and management 
process as soon as a person of concern is identified, threat managers are more likely to succeed in 
preventing a violent outcome. Steering a person in a different direction early on may mean offering 
assistance to someone who needs it before that person concludes violence is necessary. 


Research 

Scientific research and lessons learned from completed acts of targeted violence have added 
significantly to the body of knowledge about who commits it and why, what warning signs may be 
evident, and more. This increase in knowledge suggests that law enforcement agencies and other 
entities may consider developing methods to address threats of violence by persons of concern from a 
prevention standpoint, where feasible. Guidance is available from various sources to institutions and 
organizations that need to develop policies and procedures aimed at violence prevention. Research- 
based data are becoming increasingly available to assist in assessing violence risk within the context of 
mental health assessment. Foundational studies such as the Exceptional Case Study Project? and the 
Safe School Initiative* addressed targeted violence. Though they have been advanced by a significant 
body of additional research and thought, their key findings remain core to this discipline. Both studies 
focused on the thinking and behavior of planned violence offenders leading up to their crimes. They 
found most offenders did not threaten their targets directly, but prior to the incidents they displayed 
identifiable behaviors reflecting potentially violent intent. These conclusions support using an evidence- 
based approach to assess persons of concern by evaluating behaviors in order to determine the 
appropriate level of concern. 


Invaluable resource materials derived from research and experience are publicly available, such 
as those identified in Appendix F. These resources, largely used to create this guide, lay the framework 
and build a convincing case for public and private entities to incorporate the threat assessment and 
management process for gathering, assessing and managing concerning persons and situations via 
strategies for preventing targeted violence. 


In addition to qualitative and quantitative research, targeted violence incidents themselves 
represent an additional and invaluable source of knowledge and experience for threat assessment 
practitioners and policymakers alike. For example, as a result of the 2007 tragedy at Virginia Polytechnic 
University, the Virginia legislature passed measures resulting in an improved emergency evaluation 
process in that state, modified criteria for involuntary commitment, tightened procedures for mandatory 
outpatient treatment, increased state funding for community mental health services, requirements 
for better collaboration between the courts and the services system, and the establishment 
of data systems for monitoring and oversight of the commitment process.° This tragic incident 
also provided learning material for threat assessment professionals regarding risk factors and missed 
warning signs, losses of opportunity to intervene, the violent behaviors themselves, and more. 

With every incident, lessons are learned. 


The symposium participants’ intentions and hopes for this guide are to summarize much of this 
knowledge for organizations and communities, in furtherance of a goal of standing up teams and 
processes to manage threats of planned violence. 


Barriers to successful engagement 

Entities identified below all potentially play a role in threat assessment and management. They 
may encounter or inadvertently cause barriers to successful engagement. Threat management is about 
diverting dangerous and concerning behaviors away from a course that would ultimately lead to an act 
of targeted violence, and any person or organization interacting with a person of concern can impact the 
course of events. As a proactive measure when faced with a person of concern, referral of the matter to 
a local threat management team is always a good choice, and is at minimum preferable to doing 
nothing. 


> Law enforcement: Most uniformed law enforcement organizations are stretched thin as it is. It 
can be difficult to devote resources to preventing something that may or may not happen. Law 
enforcement agencies, their officers and agents, and leaders may consider becoming versed in 
preemptive measures to prevent violence to the extent practicable for each agency and community. 
Awareness can be developed about threat assessment and how it fits into daily operations. 


> Prosecution: Prosecutorial discretion and ingenuity are highly effective tools in threat 
management, and their use is encouraged. Even low-level cases may be worthy of pursuit in order to 
hold a person of concern accountable; another goal may be to deter violent behavior. Prosecutorial 
agencies should view themselves as part of the solution. 


> Schools: Schools are responsible for maintaining a safe and positive learning environment for all 
students. The desire to avoid conflict or trouble can unnecessarily create obstacles and ultimately do 
disservice to persons of concern and to the general population at a school. Information should be 
shared with threat managers where permissible, and schools should be part of threat management 
solutions. 


> Social services: These agencies address needs and facilitate access to services for at-risk 
individuals and families; they also engage at the community level to improve lives. The social services 
system may be more overburdened than any other in the overall threat management process, which 
creates serious challenges for it in performing its functions in a safe and effective manner. Social 
services can offer invaluable resources in the quest for successful threat management; the impact of 
these resources can be enhanced via co-deployments with other components of the team and by 
referring problematic issues for collaborative engagement. 


> Health care systems and providers: The health care system is similarly overburdened, which 
creates challenges related to evaluation, diagnosis, and treatment of at-risk individuals. Ideally, health 
care workers at all levels might develop awareness about threat assessment and how violence and 


mental illness intersect. They should be open to sharing information with threat managers when privacy 
laws permit sharing, and in all cases be receptive to receiving information from law enforcement and 
others to help inform their own clinical judgments. 


> Lawmakers: Members of legislative bodies have the responsibility for solving problems left by 
gaps in the law; unfortunately, these gaps are many and varied. These are not simple issues with 
obvious, single solutions. It is recommended that lawmakers remain mindful that statistics rarely 
provide proof of successful prevention; only tragedies make the headlines, whereas successful 
prevention efforts are difficult to measure. Regardless, prevention programs require resources. 
Legislators are positioned to assist with providing needed resources to threat management programs. 


> Courts: Among many other responsibilities, the courts have power to issue orders for 
incarceration and other restrictions on freedom, mental health evaluations and treatment, and more. 
The influence and power of the court extends from the infancy of a case until well beyond its conclusion. 
It is recommended that courts achieve fluency with mental health issues, particularly where violence is 
concerned. Courts are encouraged to think of judicial discretion as an effective threat management tool; 
using every available tool could be a step toward preventing tragedy. 


> Probation and Parole: Probation and parole agencies can directly impact threat management 
cases in their unique positions of observation and control over a person of concern. Violations of 
conditions may be indicative of a greater problem. Probation and parole departments may consider 
obtaining training on risk factors, warning behaviors, and mitigators so they can recognize these signs 
and understand what bigger picture may be forming when violations occur. These agencies should be 
part of the threat management team on any case where they oversee a person of concern. 


> Employers: Persons of concern spend perhaps as much time at work as they do anywhere else; 
colleagues and leadership are uniquely positioned to observe and be impacted by a person of concern. 
Discipline and dismissals, violence prevention policies, encouraging bystander reporting and more, all 
affect how an employer manages threats of violence; none of these issues are simple or easy to 
navigate. One issue of particular significance is that former employees can still pose a threat to the 
workplace or community at large after they no longer work or live in a particular location. In order to 
plan forward-thinking management strategies when needed, employers are encouraged to either create 
or participate in threat management teams, or fully cooperate with inquiries by threat managers. 


> Parents and immediate family: In many circumstances, parents may have the best optic ona 
person of concern’s struggles and vulnerabilities, especially if the person lives at home with them. In 
some cases, parents or other family members may tend to “circle the wagons” around a minor child and 
avoid cooperation with mental health recommendations, school concerns, social services assistance, and 
law enforcement inquiry. Although often difficult, it is important for parents to remain open to 
assistance and guidance when it is needed to address concerning behavior or mental health issues. 


Addressing these issues early can have a profound impact on improving quality of life and reducing later 
violence concerns. 


> Bystanders (friends, neighbors, loved ones): Anyone with an opportunity to observe or interact 


with a person of concern may see or hear something that generates apprehension. When this happens, 
bystanders are urged to communicate that information on to an appropriate person, as referenced 
below in “Bystanders.” 


Early recognition of barriers 

As soon as a team receives a new report and an assessment and strategy are being considered, it 
must also begin thinking about what obstructions may surface. The earlier a threat management team 
recognizes particular hindrances, the more effectively it can address them. Barriers at multiple stages 
can inhibit effective management. Some barriers may be intentional (e.g., a resistant parent) and some 
may not be (e.g., confusion about privacy laws and information sharing), but all can complicate the 
process. 


Barriers to successful engagement vary in degrees of difficulty, and can be encountered 
throughout the process. For example, erroneous information may surface during any stage of 
assessment. This common occurrence can cause threat managers to treat unsubstantiated rumor as 
fact and exhaust resources prematurely, or lead to a stalemate wait-and-see circumstance wherein they 
lack sufficient, corroborated information upon which to base case decisions. Avoiding these barriers 
requires threat managers to carefully validate information when it is received. As threat management 
teams mature, they will become increasingly adept at identifying and navigating challenges. Members 
should always take the time to consider all obstacles during every assessment. 


Self-awareness 

Stakeholders and threat management teams should be on guard against becoming barriers 
themselves. They may inadvertently minimize concern for a variety of reasons. Members may find 
themselves desensitized to a person of concern who has been an annoyance for a long period of time, or 
they may be uncertain about what particular behaviors truly mean. They may have difficulty in accepting 
that a true violence concern could exist in a given community. There may be uncertainty about which 
stakeholder is responsible for a case. 


Additionally, stakeholders or teams may erroneously believe that responsibility for a case or 
particular issue falls to another organization, or they may simply not know their own organizations’ 
policies and authorities. They may fear being sued or fear inadequate liability protection in the event of 
litigation; while this is a natural and likely inevitable concern, the obstacle arises when this fear becomes 
crippling to the point where no action is taken. These potential barriers may be alleviated by 
establishment of sound policies and procedures grounded in law and established responsibilities. Tools 
like non-disclosure agreements, memorandums of understanding, and/or standard operating 
procedures can help. 


Information sharing 

Another potential barrier to effective engagement is open information sharing amongst entities 
and threat management teams. It is critically important that stakeholders and team members alike 
completely and accurately share information to the extent possible. For example, school administrators 
can share staff observations and social services can share information about family dynamics. There are 
times, however, when information sharing is subject to limitations by law. For example, only law 
enforcement agencies are generally entitled to view criminal history information, and certain limitations 
on disclosure apply to health information and educational records. These limitations do not translate to 
absolute prohibitions, and one must understand what federal and state laws allow before proceeding. 


Violence and mental illness 

Researchers have been exploring the relationship between mental illness and violence for the 
better part of four decades. On balance, studies show a small but significant relationship between 
serious mental disorder, particularly psychotic disorders, and general violence risk.© Although most 
people with a major mental illness do not commit violent acts, the likelihood of it is slightly greater for 
someone with a serious mental illness than for someone who is not so afflicted. Co-occurring variables 
can either enhance or decrease risk. Risk factors include past violence, childhood exposure to violence, 
substance abuse or dependence, and numerous environmental stressors.’ When considering targeted 
violence, substantially higher rates of severe mental illness have been observed among adult mass 
murderers, public figure attackers, and lone actor terrorists than in the general population.® 


Behavior, not diagnosis 

It can be tempting to get caught up in questions about a person of concern’s mental health 
diagnosis, particularly when vague statements are made to suggest he may be unstable, hear voices, or 
“may” have been diagnosed with a disorder. Understanding that a specific behavior can be connected 
to a specific diagnosis may help validate observations and reports of others. For example, knowing 
someone has been diagnosed on the autism spectrum can help explain and validate observations about 
strained social interactions, lack of visible emotions, and inflexibility with routines. However, it can also 
foster unsupported assumptions about other behaviors which may not be occurring. Initial diagnoses 
are sometimes incorrect due to any number of factors, or they are later amended or clarified. After all, 
a person being evaluated may very well demonstrate different symptoms or behaviors at different 
times, leading to diagnostic uncertainty and flux. It is best to avoid becoming focused on diagnosis 
when a person is being assessed for violence potential. 


Ultimately, behaviors are the foundation of any mental health diagnosis, but they do much more 
than simply inform diagnosis and treatment. Behaviors can be clues to a person’s intentions. For 
example, if threat managers learn that a person of concern was discovered in a potential target’s 
neighborhood and he does not normally belong there, that could be evidence of pre-operational 
surveillance. Whether the person who is conducting the approach behavior is diagnosed with 
schizophrenia, antisocial personality disorder, or nothing at all is much less relevant at this juncture. 
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That a person of concern may be actively involved with surveillance of a target, rather than what 
diagnosis might be affecting this behavior, is what will drive the threat assessment. 


However, information about a specific diagnosis may be quite helpful during threat 
management. Different internal states implicate different techniques to reduce violence concern. For 
example, a recent case involved a highly paranoid individual with whom law enforcement had to 
successfully interact in order to manage violence concerns. During what was to be a lengthy encounter, 
detectives brought prepackaged and sealed food and drink to counteract any paranoia he may have felt 
about being poisoned by others—one of his ongoing perceptions. 


Threat assessment and management is an intertwined, dynamic process with mental disorder 
symptoms and diagnoses being several pieces in a larger puzzle. 
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Chapter 2 Identification: An Essential Step for Threat Management 


Low probability/high impact events 

Targeted violence attacks generate fear and anxiety. The seeming randomness of these crimes 
leaves members of the public wondering if they are safe at any given time. In reality, targeted violence 
attacks represent a low base rate, albeit high impact, crime. Base rate refers to the frequency of these 
events in a certain population over a certain period of time. The base rate for school attacks will differ 
from the base rate for public figure assassinations, though both are examples of targeted violence. 


Even one homicide is too many. However, the generally low incidence of this kind of offense is 
worth noting. As of 2006, the average American K-12 school could expect one of its current or former 
students to be involved in a homicide on its grounds about once every 13,870 years.” Even with 


t,!° student-associated 


frequency of targeted violence shooting events on the rise at this momen 
intentional gun deaths at school have risen and fallen multiple times since 1992.11 Workplace homicide 
has declined significantly since 1993, and continues to do so, although it remains a significant problem.” 
The sort of violence this guide concerns itself with, however, is less apparent in typical statistical reports. 
It is difficult to find consensus on the number of targeted violence attacks regardless of venue, because 
the exact criteria for counting an incident often varies among academic researchers, media, and the 


government. 


That said, this guide was not written to highlight statistics and probabilities. It was written 
because these incidents are horrific, wrenching, and, symposium participants believe, may be 
preventable. As for randomness, they are rarely, if ever, truly random. The term targeted violence 
refers to an incident of violence where a known or knowable assailant chooses a particular target prior 
to a violent attack.* The chosen target may be one or more individuals, a class or category of 
individuals, or an institution. The offender may not actually reach or ultimately harm the chosen target 
for any number of reasons, but pre-event target selection of some kind has been made. This targeting 
is, in a sense, one of the keys to prevention. It likely means the would-be offender has a personal 
grievance toward someone, a group of persons, or perhaps an organization. It may be openly 
expressed, along with the idea that violence is the only valid solution to the problem perceived by the 
grievant. Research, planning, and preparation are likely needed in order to ensure success. Other 
behaviors, as well as expressions and communications, may hint at or outright announce an intention to 
become violent. All of these mental and behavioral “waypoints” along a pathway to violence may be 
observed by someone, who can in turn report to authorities. 


Bystanders become upstanders 

Bystanders are the force multiplier of threat management. They are the extra eyes and ears for 
threat management teams, school administrators, human resource managers, police officers, and others 
responsible for the safety of others. The value of bystanders in prevention efforts cannot be overstated. 


Bystanders are a key component for prevention of targeted violence events. A bystander is 
anyone positioned to have awareness of risk factors or to observe warning behaviors related to a person 
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who may be considering acting violently. A bystander can be a friend on social media, a classmate, a co- 
worker, a neighbor, a family member, or a casual observer. The term upstander has been previously 
used to describe individuals who spoke out against genocide, and more recently in the context of 
countering bullying. It may more accurately describe the desired response in bystanders—that they will 
report what they know or see to law enforcement, human resources, school staffers, or a caring adult. 
An upstander can potentially intervene by various means, but most importantly by simply conveying 
what he knows, observes, or fears may happen. 


Creating Opportunities 


Transforming bystanders into upstanders is a must. 


However, bystanders may feel overwhelmed by or fearful of There are programs scattered throughout 
informing on a friend or associate, because of any of the the country aimed at achieving 
following concerns: knowledge and familiarity with students, 
especially at-risk ones. One model for 
> Potential for ridicule ensuring that caring adults have “eyes 
> Potential for reprisal either from the person of on” every student follows this general 
concern or from the organization format: imagine a large chart with all 
> Appearance of being a “snitch” school staff names listed across the top 
> Potential of not being taken seriously for each column, and each student name 
> Uncertainty about the seriousness of the USEEG TOW ITHE Side er EaeItOW, 
F : : : Staffers mark the box for each student 
information or situation 
. . — . they know by name and with whom they 
> Mistrust of confidentiality or mistrust of the system : 
can comfortably have a conversation. A 
to handle the situation appropriately box lerieomaletel smpiyneprecenisa 
> Desire to remain uninvolved in the affairs of others student with no relationship with a caring 
> Other concerns which may be unique to each person adult at the school—no eyes are on that 
student. Special attention is then paid to 
The upstander asks not what should have been establishing some kind of relationship 
done, but what can! do? A culture of shared responsibility between at least one staffer and that 
helps the upstander feel comfortable doing this. Upstanders student. If successful, no student 


also do not assume others will carry the burden of reporting. completely slips thraugh the cracks at 


: , ; ; that school. This system may not bea 
Steps must be taken to ensure that, in policy and in practice, ae ; ; y ; 
a ' . : full-proof measure against violence, but it 

upstander reporting is valued and treated with discretion . 
: : may dramatically reduce the chances that 

and respect. The occasional problematic reporter, or aieser ek ctudeniwilleniraldamnuard 


someone who may tend to over-report behavior that may Guteidedhiawarenessor those 
not actually pose a concern, may happen. However, working empowered to help. 


from an assumption that most people have both a genuine 
interest in doing the right thing and are not hypervigilant to benign behaviors, will serve this purpose 
well. 


Among key research findings is the certainty that upstanders are an absolutely critical 
component of prevention. In one study,’° researchers found that in 81% of school shooting cases they 
reviewed, the offender told at least one person about the attack beforehand. In 59% of cases at least 
two other individuals had some information about the event before it was carried out. This alone 
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suggests that upstanders are invaluable resources who create opportunities for intervention and 
ultimately prevention. 


Research of both successful attacks and potentially prevented cases reveals several observations 
about bystanders: 


> Bystanders may take steps to convey information, or they may do nothing 

> The school/workplace/environmental climate directly affects whether bystanders come forward 

> Bystanders sometimes do not believe violence will actually occur, or they misjudge the 
likelihood and immediacy of the threat 

> For student bystanders, parents or parental figures influence whether they will report?® 

> Bystanders are more likely to report if there is an anonymous way to do so, if the means of 


reporting is clear and easy, and if they believe the authority receiving the report to be 
trustworthy 


In view of the impact these events have on communities and the nation, virtually everyone in 
society can be an upstander. They should be viewed as such and, more importantly, encouraged to view 
themselves as such. 


Ideally all community members will be upstanders. When someone hears or sees something 
concerning from children, family, friends, neighbors, or co-workers, they might ideally ask questions or at 
least think about whether there is a concern that should be brought to the attention of authorities. 

For example, one recent case involved a juvenile who received hundreds of ball bearings by mail order, a 
fact known by his parents. When his parents asked, their son provided an explanation that did not 
necessarily make sense and yet went unchallenged. Subsequently, the juvenile used the ball bearings to 
construct several improvised explosive devices with an intention to engage in violence while his parents 
remained unaware of his true intent. 


Opportunities for identification 

Each bystander in a person of concern’s sphere represents an opportunity to identify potential 
warning behaviors. Behavior supports assessments as to the appropriate level of concern and guides 
management strategies. One concern is that bystanders may be unaware of the importance of the 
information they possess. This may be because any one person could possess a relatively small amount 
of information: perhaps a comment overheard in the hallway or a sudden flurry of odd social media 
posts. A bystander could dismiss or downplay the importance of the information because he is unaware 
the person is exhibiting many other warning behaviors outside of his field of view. It could take 
reporting from many upstanders to form an accurate picture of a case. Without the support of 
upstanders in many segments of society, threat assessment and management would be much more 
challenging. 


Threatening behavior can include communication or physical actions intended to intimidate 
others. When ignored, these behaviors can escalate to more serious problems. Someone who engages 
in harassment, intimidation, bullying or making threats must be assumed to be doing so with intention, 
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and the behavior may be repeated as long as it is [a] effective in supplying the person with something he 
wants, or [b] not stopped by an authority with the power to do so. Although not a complete list, some 
examples of reportable behavior could include: 


> Any physical violence toward a person or property 
> Direct or indirect threats of violence 
> Any act, gesture or statement that would be interpreted by a reasonable person as threatening 


or intimidating, such as overt physical or verbal intimidation, throwing objects or other gestures 
intended to cause fear, or making contextually inappropriate statements about harming others 
> Unusual or bizarre behavior that would cause a reasonable person to fear injury or harm due to 
its nature and severity, such as: stalking; erratic or bizarre behavior suggestive of mental 
disturbance or substance abuse; fixation with mass murder, weapons, or violence generally; or 
fixation with hate group, terrorist, or extremist material 
> Any statements or behaviors indicating suicidality 


A more complete summary of concerning behaviors which may be worthy of upstander reporting is 
found in Chapter 3, Assessment: Analysis for Guiding Management. 


Reporting and reporting mechanisms 

Reporting is an essential part of prevention. Reporting mechanisms should be easy to 
understand and effective at getting information to someone empowered to act on it. Transparency is 
advised, including clear notice regarding to whom a report should be made, how it may be reported, and 
preferably offer multiple options for each. An anonymous reporting system should be an option. While 
perhaps not ideal in all instances, it may be the only way some people feel comfortable reporting. 


To maximize observation and reporting of warning signs, organizations and communities should 
foster an environment of shared responsibility by: 


> Designing a strong violence prevention program 

> Developing reporting mechanisms that are easy to understand and use 

> Creating organizational policies to structure and implement these concepts to encourage 
reporting 

> Providing training for upstanders, leaders and threat managers to ensure effectiveness 


Creating a culture of shared responsibility 

Ultimately, a culture of shared responsibility will further the goal of prevention. One thing that 
sets upstanders apart is that they often feel a positive emotional connection to their environment—to 
school and staff, to the workplace, or to a larger community. This connection seems to be fostered by a 
climate of safety and respect, wherein people feel joined with the community or organization and 
believe that others in that environment know and care for them. For example, in school settings this 
happens when social and emotional interactions occur daily between students, staff, and teachers. 
Upstanders are more likely to report their concerns when they believe all information is valued and that 
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coming forward will not cause harm. Targeted violence offenders sometimes convey vague information 
about the possibility of an attack, which very reasonably may cause a bystander to be concerned about 
overreacting. Uncomfortable gut feelings about inappropriate conduct are worth reporting, and 
someone trained to understand targeted violence can evaluate the information. An upstander may 
have one small piece of information which in turn is used to complete the larger picture; without it 
authorities may be unable to accurately assess a situation. 


Making a threat versus posing a threat 

A threat is an expression of intention to inflict injury or damage’’ and is often one of the first 
ways a person of concern may be identified. Whether it is an actual expression of intent to do harm, a 
“leakage” of violent thought, or merely an inappropriate statement, it is something that needs further 
exploration. Threat assessment may begin when a threat is reported, but it does not end there. All 
threats are not created equal, although they must all be taken seriously and thoroughly evaluated. 
Content (i.e., the words or deeds used), context (i.e., what happens before, during and after a threat is 
made) and circumstances (i.e., surrounding facts, such as method of delivery, relationship between 
threatener and target, or type of target) must all be thoroughly assessed in order to determine what 
level of concern is appropriate when a threat is made. 


A direct threat has been defined as an unambiguous statement to a target or to authorities of 
intent to do harm. In many circumstances there is little to no correlation between a directly threatening 
communication and a subsequent act of targeted violence.*® This is most likely to be true when no 
relationship exists between the threatener and target. Conversely, when a threatener and target do 
have a relationship, violence becomes more likely to occur. This concept is discussed in detail later in 
this section. 


Whether an individual has actually conveyed a threat should not be a driving factor in the 
decision to follow through on a report. In fact, for a person who truly intends to do harm, making a 
direct threat would be quite counterproductive. Doing so naturally causes a logical and predictable 
chain of events to begin to unfold, including investigation, increased vigilance, and target hardening, 
each presenting challenges to the would-be offender. 


While directly threatening communications should be thoroughly evaluated, a genuine 
forewarning of violence is often not intended by the threatener. Conversely, a person could pose a very 
real threat of violence without ever communicating that idea to anyone. Stakeholders should consider 
the communicated threat, but the focus should be on whether the person poses a threat through the 
consideration of all information. It is important to understand: 7° 


> Some persons who make threats ultimately pose a threat 
> Some persons who pose a threat never make threats 
> Many persons who make threats do not pose a threat 
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Postponing action until a person of concern has overtly threatened someone may be a grave 
mistake. However, if a decision is made to interview or confront a person of concern, he may deny any 
ill intent and even apologize for causing concern. Denial places threat assessors in a difficult position, 
particularly where there may be fear of litigation or complaint by the person under scrutiny. Even so, a 
denial of intent to do harm should not be taken at face value, as it is not proof of benign purpose. 
Someone truly intending to hurt others will rarely admit it when confronted with his threatening 
statements or actions. Outright denial, rationalization, or minimization can be tactics to avoid 
immediate repercussions, to allow him to continue on unfettered, and/or to allow him to enjoy 
manipulating the situation. Not everyone who engages in menacing and threatening behavior intends 
harm. However, simply taking a person’s word for it when he has already demonstrated an inability or 
unwillingness to behave appropriately is unwise. Rather, the denial should be considered a piece of 
information in the evaluation of the whole case. 


Intimacy effect 

When both threatener and target are known, particular attention should be paid to their 
relationship in attempting to assess the appropriate level of concern for violence. Threats become more 
valuable as pre-incident indicators of violence when the degree of intimacy between a threatener and 
target increases.7° This is referred to as the intimacy effect. Actual intimates are very close, of course, 
and therefore it is appropriate to assign a high level of concern to cases of threats, harassment and 
stalking directed toward an intimate or former intimate. These cases can also have a “spillover” effect 
at work, school or public places, wherein opportunistically chosen victims are targeted in addition to the 
desired one. One study found that over 70% of men who murdered their intimate partners explicitly 
threatened to do so beforehand.” Other degrees of intimacy exist and should be considered. Work 
colleagues, students at the same school, and members of the same congregation or community all have 
degrees of closeness. This relationship allows a threatener to know where a target spends time, what a 
target’s vulnerabilities might be, and could also provide sufficient emotional investment for a threatener 
to feel angry or humiliated if his threats fail to provoke the desired behavior. Should a target decide to 
refuse demands or fail to demonstrate the desired reaction, the threatener may then be faced with a 
choice: admit his impotence or take action to show the target and possibly the world that he should 
have been taken seriously. Strangers, particularly those separated by significant distances, have the 
lowest degree of intimacy and therefore threats made in that context do not automatically generate the 
same level of concern. 


Stalking 


Not all stalking cases will include an act of targeted violence. However, in the broadest definition of 
the word stalking—hunting for prey—it can be argued that every act of targeted violence involves 
some aspect of stalking. All stalking behaviors, historical and current, should be considered as part of 
any threat assessment, regardless of whether the stalking has anything to do with the person of 
concern’s identified grievance. 


A person of concern who has engaged in previous stalking incidents may demonstrate ability to engage 
in research, planning, and preparation towards a target. The use of those terms—the middle steps on 
the “pathway to violence” —demonstrate even further the association of stalking with targeted 
violence. (See pages 24-25, 32-33) Stalkers may also be described as “fixed” and “focused” which are 
dimensions to be considered when assessing the potential targeted violence offender. The person of 
concern’s stalking behaviors should be evaluated for recency, frequency, and severity as they may be 
illustrative of the problematic way he engages with others and/or the unhealthy way he interacts with 
the world. This information will allow threat management teams to evaluate the individual’s ability to 
engage in pathway behaviors and how quickly he may navigate the stages. It may be that a person of 
concern’s previous incidents of stalking were unintentionally a training mechanism for future targeted 
violence. 


A stalking case may be the reason a person of concern is brought to the threat management team. All 
stalkers should be considered “persons of concern” within the context of this guide. The assessment 
for violence should be explored in any stalking investigation; utilizing a threat assessment team is an 
ideal way to accomplish this task. While there is research on the link between stalking and targeted 

acts of violence, it has yet to be fully understood and all too often incidents of stalking are minimized. 

Currently, there is no consistent mechanism amongst jurisdictions to record whether stalking behaviors 
preceded a homicide. The true association between stalking and other targeted violence warrants 
further study. It is not a mere coincidence that stalking behaviors have been identified in the timelines 
of previous targeted attack cases. 


The team should be mindful that many stalking cases are unreported, as such the absence of a stalking 
charge in an individual’s record is not reflective of his potential engagement in this crime. Often in 
stalking cases, other charges such as trespass or criminal mischief may be used to criminalize the 
actions of the offender. Obtaining the actual police reports in such cases may reveal the underlying 
stalking behaviors. Further, the fact that a stalking case may not have risen to a criminal level does not 
diminish the concern of the stalking behaviors. Such information may be garnered through the 
interviews of the family, friends and associates of the person of concern. It is of utmost importance to 
be cognizant of and not dismiss any signs of current and historical stalking conducted by the individual. 
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Anonymous communicated threats 

Many threatening communications are sent anonymously. They may come in the form of notes, 
emails, bathroom wall scrawls, or other methods. In addition to attempting to assess an appropriate 
level of concern (See Appendix A) provoked by the communication itself, logical investigation should be 
conducted when these are received in an effort to identify authorship. When a threat is made, the 
threat itself should be assessed by considering several variables, including the manner and context in 
which the threat was conveyed and the apparent relationship between the threatener and the target. 


Electronic threats can be a particular concern—the internet age has made it entirely too easy to 
threaten and harass just about anyone anonymously. Anonymity, whether real or perceived, increases 
disinhibition and lowers behavioral constraints normally felt during more personal interactions. The 
perceived absence of monitoring or controls, as well as the ease of finding like-minded virtual friends, 
can also reinforce bad online behavior (see page 50: Pronoid pseudo-communities).2* Does this 
necessarily correlate with increased violence risk? Much work remains to be done in the area of 
electronic threats research. Although data are preliminary, threatening Tweets are not thought to be 
predictive of a physical approach absent other simultaneous activity or contact toward a target.”° 
However, as with any case, each circumstance warrants individual scrutiny, paying particular attention 
to: 


Any noted patterns of escalation 

Intensity of effort and focus observed in a pattern of communications 
Potential leakage of harmful intent (See pages 34-35: Leakage) 
Evidence of a personalized motive by the threatener 

Expressed intention to approach 


VVVV VV 


Justifications for violence2* 


Analysis of threatening communications 

Several questions may help assess level of concern for violence when a threatening 
communication is received. These are a few generalities for consideration and not an all-inclusive list of 
communication assessment questions. Each case is unique and contains numerous variables, all of 
which cannot be accounted for here. 


> What is the relationship or prior contact between threatener and target(s)? 
o The degree to which the intimacy effect is applicable should always be considered 
> Does the method of delivery indicate physical proximity by the threatener? 
o Signs of a possible approach may be more concerning than a long-distance mailing 
> How many communications were received, by whom, and over what time frame? 
o Increasing intensity of effort (measured by frequency, duration, and different means of 
communication) may be a sign of escalation 
> According to the threatener, when will the threatened action or consequence happen? 
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o Generally, alerting the target and authorities to a violent plan is counterproductive to 
success; however, anniversaries and dates which are significant to the author may be reason 
for concern 

o  Anexpression of time running out or a looming deadline may justify increasing concern 

> What is the significance of any identified dates or places? 
o Certain dates or places may be symbolic of past attacks or upcoming events which have 
meaning to the threatener 
> Is the threatened plan of harm feasible, given what is known about the threatener? 
o Highly unrealistic plans may be indicative of an insincere threatener 
> What details are known about any grievance or issue identified in the threat? 

o Threats involving a personal motivation or justification for violence are generally cause for 

greater concern than those which merely threaten 


First Amendment protected speech 

First Amendment protected speech principles are implicated where public communications are 
concerned; privacy rights, on the other hand, govern the gathering or viewing of private 
communications or other personal items of relevance in a case. As a threat assessment strategy, 
monitoring a person of concern’s communications is sometimes recommended; these may include 
publicly accessible social media or weblog (“blog”) posts, school essays, articles, books, or 
communications authored by the person. These options, like any other threat assessment option, must 
be considered in view of legal authorities and protections, including the fundamental right of free 
expression guaranteed by the First Amendment to the United States Constitution. 


The First Amendment protects this right. However, not all forms of expression are protected 
“speech.” It is important to understand the line between Constitutionally-protected speech, and 
advocacy of violence or conduct that may lead to violence or other unlawful activity. The First 
Amendment does not protect, among other things, “true threats,” fighting words, incitement of 
imminent lawless action, or material support to terror groups. Context, target, and intention are all 
important to figuring out whether something is an unprotected “true threat” as defined by the US 
Supreme Court. Ina “true threat,” the threatener intends to communicate a serious expression of intent 
to commit unlawful violence against an individual or group; he need not actually intend to carry out the 
threat.2> Since the lower courts do not entirely agree on how to apply this definition, in those cases 
where a threat has been made and a threat assessment team may be recommending prosecution, 
consultation with the prosecutors is necessary to determine whether the statement in question is 
protected speech. 
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In addition to purely First 
Amendment considerations, 
governmental agencies must have an 
authorized purpose for monitoring 
someone’s speech. One such authorized 
purpose is trying to determine whether 
a person is exhibiting behaviors that 
pose aconcern for significant and 
imminent violence. In cases involving 
protected speech, for example, where 
someone has not articulated a threat, 
the government cannot take an action 
that destroys, or even significantly 
diminishes, his ability to communicate a 
public message or idea through his 
words or deeds. 


In a school setting, conduct on 
school campuses that either 1) 
materially disrupts class work, or 2) 
involves substantial disorder or invasion 
of the rights of others, does not carry 
First Amendment protection.”® Ina 
workplace setting, employees are not 
entitled to unrestricted speech on any 
topic; they must be speaking about a 
matter of “public concern” in order to 
have First Amendment protection.’ 
Simply stated, context matters. The 
First Amendment has limitations, and 
courts “will consider time, place, 
manner of expression, and 
organizational and individual impact” 
when deciding whether an expression is 
protected by the First Amendment.”® 


Elonis v. United States — Online Threats 


In Elonis v. United States, commonly referred to as “the 
Facebook threats case,” the United States Supreme 
Court examined the “guilty mind” necessary for a 
conviction under federal law for communicating 
threats in interstate commerce. Mr. Elonis posted a 
number of disturbing statements on his Facebook 
account, stating a desire to kill his estranged wife, a 
kindergarten class, and law enforcement officials who 
investigated his threatening behaviors. His statements 
were often specific and brutally violent. Mr. Elonis 
maintained that he did not mean to threaten anyone; 
rather, he meant to engage in artistic expression as a 
rapper. The case was originally expected to be decided 
on First Amendment grounds. However, rather than 
focusing on free speech the Supreme Court reversed 
his conviction on a technicality. News of the reversal 
nevertheless created a degree of false fear that 
internet threat cases would be difficult to successfully 
prosecute. 


When considering prosecution of online threats in light 
of Elonis, law enforcement is encouraged to collect and 
memorialize, during data collection and interviews, any 
evidence that tends to prove a person of concern who 
transmitted a threatening message did so for the 
purpose of issuing a threat or with knowledge that the 
communication will be viewed as a threat. Ifa 
threatener alleges he intended only sarcasm or humor, 
investigators should be on the lookout for evidence 
that contradicts this allegation. Any circumstantial 
evidence that counters a threatener’s position that his 
threats were just “artistic expression” may also be 
helpful. As a final note, in those cases where law 
enforcement officials admonish a person of concern 
who makes an online threat, they should carefully 
document the admonishment and the threatener’s 
responses, demeanor, and behavior. 
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Chapter 3 Assessment: Analysis for Guiding Management 


Targeted violence threat assessment is complex. High level of violence concern almost 
invariably results from many factors, only some of which may be plainly visible to a threat assessment 
team. There will be unknown details in every case. This is a primary reason why threat assessment is a 
nuanced and complex discipline. A great deal of time and study is required to develop proficiency in 
threat assessment. As human behavior is variable in nature, thoughtful consideration of many facts and 
circumstances is required to conduct a thorough assessment. 


There are no “usual suspects” 

There is no demographic profile of a targeted violence offender. Objective assessment of threat 
enhancing and mitigating circumstances is the key to evaluating concern for violence. Any individual, no 
matter what age, sex, race, religion, education or income level, marital status, or occupation, has the 
potential to engage in targeted violence. The first step in preventing future violence is identifying and 
evaluating a person’s behaviors. No single behavior is predictive of targeted violence; rather, a “perfect 
storm” sometimes develops based on a multitude of factors and conditions. When conducting an 
assessment, the facts and circumstances identified in this chapter must each be examined while 
focusing on the person of concern, the potential target(s), the situation, and the setting. Threat 
assessment is a multifaceted process, stemming from a holistic analysis of the pattern of behaviors 
displayed by a person of concern. 


Data interpretation and weighting 

A checklist approach to assessment can work to ensure relevant topics are considered, but not 
for deciding how much weight to place upon each fact and circumstance. Assessment of each fact and 
circumstance must be uniquely weighted based upon: 


> What makes up the whole person, including his behaviors and characteristics 
> Any direction of interest in persons, places, or issues demonstrated by the person of concern 
> The situation including a grievance, environmental and contextual factors, or recent or 


anticipated losses 
> The setting including organizational culture and the physical setting? 


Totality of circumstances versus singular points of assessment will drive the ultimate level of 
concern held by a threat management team. Human judgment applied to each factor on a case-by-case 
basis is the only endorsed method of violence threat assessment. 


Bias 

"Analysis at a glance" is a threat assessment hazard. Unintended bias by assessors must be 
understood and avoided. There are several types, each posing its own unique challenge. The BAU 
suggests that threat management teams adopt an evidence-based, structured approach to its work, 
rather than a biased approach. 
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The tendency to look for evidence or interpret information in a way that confirms a 
preconceived opinion is confirmation bias. Human nature is often such that it is easier to notice facts 
that support already held beliefs and overlook facts that do not. Further, this bias can also cause one to 
give greater weight to such information because of the tendency to accept it at face value without 
scrutiny. Even worse, people are usually better able to remember such information. For example, a 
preconceived belief is "| know John is going to end up shooting up this place because he has been angry 
for a long time." To support this opinion, one might then only collect examples of when John’s anger 
has attracted attention—while ignoring examples of his positive behaviors. 


Availability bias is a tendency to assign the most importance to behavior which comes 
immediately to mind—if it can be recalled quickly then it must be important, or at least more important 
than other information which is not as readily recalled. This presents a risk that the most recent 
information will outweigh older information simply based upon its recency rather than on its 
importance. The takeaway for threat managers? Take care to evaluate behavior over time when 
possible; then it will likely become clearer if the person of concern is escalating, de-escalating, or holding 
steady. 


"Hindsight is 20/20." This statement is never truer than when discussing the predictability of 
violent attacks. Hindsight bias is the inclination, after an event, to see it as having been more 
predictable than it was. A tendency to blame based upon an erroneous belief that something was 
predictable can potentially affect threat managers, such as when a particular threat management 
technique is not successful. For example, if mental health counseling is recommended but fails to de- 
escalate a person of concern’s behavior, those critical of the threat management process may blame the 
team for making an incorrect recommendation because the person of concern reacted negatively to a 
suggestion he attend counseling. Hindsight bias facilitates a potentially erroneous argument that the 
team should have predicted that counseling would fail, when in reality there would have been no way to 
know that before implementation. 


Hindsight bias can affect threat assessment and management by inducing foresight bias, which 
emphasizes an unrealistic ability to predict future events. This kind of bias could cause stakeholders or 
threat managers to erroneously apply outcomes in previous cases to the current one, even when the 
fact patterns are dissimilar. For example, one assailant posted what he called a “manifesto” online 
before offending against a camp of juveniles. Foresight bias might cause observers to conclude that 
every troubled person who posts a manifesto is about to engage in violence. Psychologists, in particular, 
have faced the challenge of being asked to predict who will become a violent offender from among the 
overwhelming majority of non-violent mentally ill; even with the best available instruments general 
violence prediction is only moderately accurate. 


Biases can occur or become more pronounced when fatigue or complacency become an issue. 
These problems can affect threat managers and stakeholders during a long term, repetitive, or unusually 
intense case. In those situations, threat management teams should remember that facts and 
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circumstances can quickly change a case and the level of concern for violence it generates. Thus, teams 
should consider how best to mitigate fatigue or inadvertent complacency. Team structure itself may 
assist in reducing fatigue because the weight of a case, or all cases, does not rest on one person alone. 
Teams must also be on guard against complacency by remaining focused on the task at hand and 
maintaining a positive mental outlook. 


Triage versus 360° assessment 

A primary purpose of an assessment is to inform decision-making regarding how, and how 
quickly, to best manage a person of concern away from violence. An assessment is only as good as the 
information upon which it is formulated. The quantity and quality of information collected will likely 
dictate the assessment's degree of accuracy and utility. In addition to addressing concerns about public 
safety, stakeholders should also strive to promote a person of concern’s well-being. Optimally, threat 
managers would like to obtain as much relevant information as possible about the person of concern 
and the events occurring in his life, in order to devise the most appropriate management strategy. This 
is referred to as a whole person or 360° assessment. It typically requires an abundance of investigative 
effort and time. However, in instances where the information on the person of concern is unknown or 
unavailable and time is of the essence, the threat assessment can and should function more like a triage 
process. Relying on limited information which likely reveals behaviors over a short time, a triage 
assessment is used to determine case prioritization and resource allocation, and can include a 
preliminary level of concern and any immediately necessary management strategies. The use of triage 
assessments is vital, especially when multiple cases arise simultaneously, similar to emergency medical 
professionals assessing patients based on their urgency of need for care. Whole person assessment and 
triage share the same goal: to maximize threat mitigation and ultimately prevent violence. 


Having a sense of urgency and knowing when to apply it are important skills for threat managers. 
Distinction must be made between cases requiring an emergent response, and those which 
do not. This will involve being able to determine whether a particular case justifies a low level of concern 
for targeted violence risk, a high level of concern, or somewhere in between. A system in use at the 
BAU, and elsewhere, for delineating between levels of concern (See Appendix A) was inspired by the 
National Weather Service (NWS) system of [1] no message, [2] watch, or [3] warn.*° Example: the NWS 
remains silent on the topic of tornadoes on any given day for which the chance of one is not measurably 
above the base rate. The NWS issues a tornado watch when the conditions are right for the formation 
of such an event, making it possible. It does not mean one will occur. It issues a warning when a 
tornado has been sighted or is imminent. For assessing violence concern, the BAU adopts a similar 
posture, one which takes into account the appropriate level of concern for [a] violence potential, and [b] 
how imminent that violence may be, based upon an application of published research and the unit’s 
experience with case facts and circumstances. A concern level does not predict violence likelihood but 
rather expresses the extent to which conditions may facilitate violence potential. 


Standardization of processes from intake through assessment is strongly recommended; case 
management will be unique in each instance. This chapter identifies those elements which should be 
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considered in assessing a case for violence concern and imminence. These include enhancers (risk 
factors, warning behaviors, stressors and precipitating events, and indicators of potential imminence) 
and mitigators. Every case is unique and will feature varying numbers of these elements; a checklist- 
based or quantitative formulaic method for assessing a case is not endorsed. A case may have an 
overwhelming number of threat mitigators, for example, and only three enhancing factors. However, if 
those enhancers are firearms access, substance abuse, and a persecutory delusional belief system, those 
three may very well overwhelm any number of mitigators. Conversely, a single mitigator (e.g., 
convalescing due to a serious physical illness) could dramatically reduce violence concern even in the 
face of a slew of enhancers. This is where a trained and experienced team, following a standardized 
assessment protocol, becomes an effective tool for managing persons of concern away from targeted 
violence. 


Pathway to violence 

It is generally believed that persons intending to engage in targeted violent acts move along an 
identifiable pathway on their journey to attack. The progression may be rapid or slow, and will not 
follow the same course from person to person. Some scholars have proposed pathway-like maps, while 
others have identified key indicators of high or imminent risk. Recently, the pathway concept was 
proposed as merely one of eight warning behaviors. Pathways can exist in multiple and complex forms, 
or may not exist at all in some cases.22 Regardless of which model is adopted for use, threat managers 
will find that both state of mind and outward behaviors of the person of concern are inextricably 
intertwined—behavior is a manifestation of thought. For the purposes of this practical guide, the well- 
known pathway to violence model which crystallized over the past twenty years and is relatively easy to 
understand, is presented. Further discussion later in this chapter will place this pathway within a larger 
constellation of warning behaviors. 


The traditionally known pathway to violence model is an excellent place to begin the discussion 
because it addresses the question of “why?” It describes a first step on the journey toward intended 
violence as the formation of a deeply held personal grievance or humiliation based upon real or 
imagined injustices inflicted upon the grievant. This grievance could be against an individual, an 
institution, or other entity the person of concern feels slighted or wronged him. It may be nurtured and 
cultivated over time, even years. Depending upon the particular individual, it may be plainly evident to 
all around him or kept hidden and private. Although there are cases of targeted violence in which a 
grievance or motivation was never identified, this appears to be rare with regard to the kind of mass 
targeted violence attacks this guide addresses. Regardless of whether a specific grievance exists or can 
be pinpointed, only a few general motives for mass targeted violence offending appear to be prevalent 
in the experience of the BAU. They include: 


> Revenge for a perceived injury or grievance 

> Quest for justice (as defined by the offender) 

> Desire for notoriety or recognition 

> Desire to solve a problem perceived to be unbearable 
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> Desire to kill or be killed 


When a person of concern for targeted violence is unable to resolve the negative emotional 
burden of unachieved justice, he could then progress to a violent ideation: the idea that violence is an 
acceptable, or even the only, means of achieving redress.*? Unable to shake off a grievance and its 
accompanying anger, despair, humiliation, or other negative emotional responses, the person of 
concern may eventually conclude that violence is justified, necessary, and his only choice. The adoption 
of this idea can be profoundly relieving, almost like a salve on a wound. It is for this reason that a 
sudden turnaround by a formerly angry, depressed, or menacing person of concern should not be 
presumed as good news. More assessment is often prudent. 


Additional steps along the pathway are discussed in greater detail on pages 32-33. They involve 
both emotional and logistical considerations important for planning and carrying out an act of planned 
violence. They include research and planning, preparation, probing and/or breach of security measures, 
and the attack itself. A key factor to remember when recognizing that someone is on an apparent 
pathway to violence, is that time is on his side. Completing the steps from grievance to attack may take 
weeks, months, or even years. Someone may appear stalled along the way; he may even retreat a step 
or two. Conversely, the entire route may be covered relatively quickly or steps may not be observable 
to a threat assessment team. The following graphic illustrates, in very simplistic terms, one of several 
pathways to planned violence models; it may be useful in visualizing the concepts discussed in this 


section. 
Attack 
Breach 
Preparation 
Research & 
Planning 
Ideation 

Grievance 


Calhoun and Weston (2003) 


The role played by mental illness 

A general stereotype exists that people who suffer from a mental illness may be dangerous.** 
There is a small but significant relationship between serious mental illness, such as psychosis, and risk of 
violence toward others. However, misinformation and/or lack of knowledge or exposure to the 
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mentally ill may grossly exaggerate this fact. Certainly, the unpredictable behaviors associated with 
some forms of mental illness can provoke concern. However, many times it is just the fear of the 
unknown associated with mental illness that makes people uncomfortable. 


In the immediate aftermath of a targeted violence event, an inference may be made that the 
reason an incident occurred is the offender was mentally ill. While serious mental illness is substantially 
present in targeted violence offenders,*° it does not necessarily follow that such illness is the driving 
force behind the decision to offend. Assessing violence potential is more complex and dynamic than 
simply determining whether or not someone has a mental disorder. Many factors, including some which 
may be interrelated, play a role in an offender’s decision to plan and take violent action; these are 
discussed in this chapter. People with serious mental 


illness may have particular vulnerability to other Homicide and suicide are more closely 
variables which increase risk, such as past linked than many think. In many 
violence/childhood exposure to violence, personality cases multiple homicides are linked 
disorders, substance abuse or dependence, and with prior suicide attempts, 
numerous environmental stressors.2° When considering gestures, or suicidal ideation on the 
serious mental illness, threat managers should assign a part of the perpetrator. This is 
logical level of significance to it, based upon the nature especially true with targeted violence. 
of observed symptoms and behaviors. A “Safe Schools Initiative” research 


project revealed that 78% (32 of 41 


From a threat assessment perspective, different . 

; : ; tee studied) of targeted mass attackers 

types of mental illness-driven behaviors may inhibit or _. . as 
; Dae . exhibited a history of suicide attempts 
enhance violence concern and/or implicate different . 
’ ; : or suicidal thoughts at some 

management strategies. There is a difference between 


point prior to their attack.?” 


someone who is so mentally disturbed that he cannot 
. . . Moreover, many offenders attempt or 
organize himself enough to plan and carry out a violent i 
: . : succeed at suicide or “suicide by cop” 

attack, and a functional person with a mental disorder ; 
. ie . . at the conclusion of a targeted 
that permits predatory thinking and violent planning, as : 
sig ; violence event. 

well as an ability and commitment to follow through. 


Threat managers should direct their attention to 
psychiatric symptoms and associated behaviors, rather 
than formal diagnoses, for purposes of assessing violence concern. Symptoms of mental disorder can be 
debilitating for the individual in question and alter his perception of others’ interactions and activities. 
For example, if he is struggling with paranoid beliefs that others are out to get him and he feels 
threatened or endangered by contact with others, he could potentially feel justified in using violent 
means to defend himself. 


A personality disorder, on the other hand, is not the same sort of disorder as a serious mental 
illness. It is an enduring, pervasive, and inflexible pattern of internal experience and behavior which is 
not in harmony with cultural expectations. Personality disorders typically onset in adolescence or early 
adulthood, and are stable over time. They feature certain attitudes, behaviors and thought patterns 
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that are maladaptive. As aresult, a personality-disordered individual may be able to conclude that 
violence is an acceptable or even necessary response to a problem.*® Because he is not, however, 
disengaged from reality, he is capable of engaging in logistical and rational processes necessary to 
violently offend. Any observed behavior that demonstrates the person of concern’s thoughts, thinking, 
planning, and organization is important to consider for understanding his trajectory towards violence, if 
any. Once these are understood, work can begin on managing behaviors and ultimately lowering 
violence concern. 


Forensic Mental Health Assessment/Violence Risk Assessment 


A foundation of mental health treatment is the relationship that develops between the patient 
and his therapist. This therapeutic alliance is essential for the treatment process to work. The 
theory behind the trust-based therapeutic alliance is that a client seeks treatment from a mental 
health professional because he genuinely wants to be helped. What this fails to take into account 
is that someone truly considering engaging in an act of targeted violence must conceal that 
intention in order to ensure success. This can be difficult for providers inexperienced in such 
cases to accept. The violence risk assessment process assists in removing subjectivity from the 
equation. 


When mental health professionals attempt to assess an individual’s potential danger to himself or 
others, they may use unstructured, clinical judgment as they interview the person about his 
history and current mental state. This falls short of a “violence risk assessment,” (VRA) ideally 
performed by forensically trained mental health professionals and which entails a much more 
systematic, structured, and thorough evaluation of the individual. For example, most clinicians 


base their suicide risk/homicide risk assessments on a patient’s self-report rather than conducting 


a multi-faceted VRA. An objective VRA involves asking additional questions of the patient which 
are predetermined and required by the tool being used, as well as gathering collateral information 
by interviewing family members, reviewing police reports, and conducting psychological testing. 
This evaluation process may interfere with trust and rapport-building and thus is not emphasized 
in general mental health provider training. However, unstructured clinical assessments are 
susceptible to the deceptions and poor insight of the patient. Mental health providers have not 
been very successful at violence prediction, which explains why forensic psychologists moved 
away from unstructured clinical assessments to more actuarial or structured assessment 
approaches to assess risk for violence. Forensic mental health professionals receive much more 
training on violence risk assessment than other providers. 


Although pursuing a formal mental health diagnosis can be a distraction during the assessment 
process, diagnostic certainty is more useful during the management phase. Diagnosis by a qualified, 
licensed mental health professional can be a bridge to strategies for interacting with the individual, 
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treatment if feasible, and an effective threat management plan overall. Mental health intervention 
should not be considered a standalone solution. Rather, it can and should be part of a comprehensive 
strategy when mental illness is an aspect of the case. Some persons of concern will be resistant or 
unreceptive to mental health treatment for various reasons. Even though they may not always be able 
to communicate back to a threat management team, mental health partners are good resources when 
psychiatric symptoms and behaviors are present. Evaluation and diagnosis can create additional 
opportunities for intervention and mitigation of any threat generated by the person of concern. 


In this guide only a few of the many issues threat managers and stakeholders may encounter 
with regard to mental illness have been identified. It is important to think about what approach and 
interaction methods will be used during encounters with persons of concern who suffer from mental 
disorders or disturbances. The BAU recommends consultation with qualified, licensed mental health 
professionals for advice during such instances. Additionally, written resources about interacting with 
the mentally ill are available which may also provide assistance (see Appendix F, References). 


The “person of concern” 

As previously noted, a holistic view of a person of concern is needed in order to conduct a viable 
threat assessment and create a management plan. However, some individual qualities below may be of 
particular interest in conducting a threat assessment. They include but are not limited to: 7 


> Strength of coping mechanisms (i.e., healthy conflict resolution, processing emotional stress, or 
tolerance for change) 

> Negative traits (i.e., desperation, maladjustment, low trust, impulsivity, inattention, irrational 
thinking, low empathy) 

> Attitude about self (i.e., narcissistic/entitled, injustice collector, positive self-esteem, future- 

oriented) 

Need for attention, recognition, or notoriety 

Response to rules and authority 

Preoccupation with violence 

Deceptiveness and manipulation 


VV VV V 


Motivation 


Brittle people 

The pathway to violence discussed above identifies a potentially observable path along which a 
person of concern may travel on the way to engaging in a violent attack. Although not every targeted 
violence event has its origins in a personal grievance, it is a common starting point. Clearly, however, 
most aggrieved persons do not go on to research, plan, prepare for and execute a targeted violence 
event. So who are those individuals most at risk for targeted violence? They are exceptionally brittle,” 
unable to withstand slights, rejections, or offenses both minor and otherwise. Time and again, targeted 
violence offenders have claimed to be persecuted and alienated from their peers, family, and the world 
at large, viewing themselves as outsiders and not part of a larger social network. They seem unable to 
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process the slights, rejections, teasing, and bullying that everyone experiences at some point in their 
lives. Most people learn to deal with these experiences as a normal, if unfortunate, part of life. Well- 
adjusted people develop emotional armor and learn to stand up to, ignore, or just ride out such 
behavior. To a brittle person lacking adequate resources to help him appropriately process and cope, 
even a minor loss can be absolutely devastating. Brittle targeted violence offenders, moreover, cannot 
seem to muster a healthy response. They continue to brood and obsess over every injustice, whether 
real or imagined, that has ever been inflicted upon them. Suicidal feelings are not uncommon. 
However, it is important to recognize that brittle people who are suicidal can also become homicidal 
toward others. 


Conducting the assessment 

In the next few subsections, threat enhancing and threat mitigating factors will be identified and 
explained, although the individuality of each human being, and therefore each case, prevents this from 
being considered an exhaustive list. In fact, there may be no such thing. Rather, this information (like 
the rest of this guide) should be considered as a general reference to get a threat assessment team 
started in conducting an assessment. With experience will come the expertise to identify additional 
enhancers and mitigators and evaluate how they fit into an overall case assessment. It is impossible to 
absolutely quantify the weight of each individual factor. Each case is a unique combination of personal 
and environmental factors which preclude assigning all relevant factors equal weight. The urge to 
quantify and calculate an assessment like a math problem must be resisted. Threat assessment 
envisions a holistic assessment of the person of concern, the potential target, the situation, and the 
potential setting for an incident. 


Threat enhancers 


Risk factors 

Risk factors are existing realities about the person of concern that may increase the risk of 
violence he poses in a given situation. They are already in place at the time of assessment. Risk factors, 
as opposed to the behaviors a person may demonstrate (discussed later), can either be static or 
dynamic. Static risk factors are historical or dispositional, will not change over time or will change very 
slowly, and are not amenable to intervention (e.g., gender, history of prior violent acts). Dynamic risk 
factors are situational or clinical, and can and do change, often rapidly (e.g., weapons possession, illegal 
drug abuse). Some risk factors are highly interrelated with behaviors (e.g., current access to a gun (risk 
factor) and actively attempting to acquire more guns (behavior)). 


Violence History 

> History of violence: The best predictor of future violence in many cases is past violence. Past 
violence might not be indicated in a criminal history report, so it is important to cover this in 
interviews, social media reviews, personnel file reviews, or other available sources. 


> Childhood exposure to violence: Violence in a person of concern’s family of origin or adolescent 
peer group has also been identified as a risk factor for adult violence. 
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Health/Mental Health 

> Substance abuse or dependence: Psychostimulants are a concern, and are encountered as both 
illicit and prescription drugs; they can increase the fight or flight response, and more importantly for 
targeted violence assessment, they can cause grandiosity and/or paranoia in some.*! Generally, 
prescription medication side effects are variable and can sometimes include violent ideation and altered 
thought processing. Alcohol lowers serotonin levels in the brain, potentially leading to irritability and 
ageression.”? The use of non-prescription substances could be evidence of self-medication for a 
diagnosed or undiagnosed issue. However, there is evidence that drug and alcohol abuse is significantly 
lower among those engaged in targeted violence than those engaged in impulsive/reactive violence. 


> Personality disturbance or disorder: Paranoia, narcissism, borderline personality, psychopathic 
or significant antisocial tendencies, or significant and sustained anger manifestations, can all increase 
risk of targeted violence and should be taken seriously. They can cause a person of concern to believe 
violence is justified and acceptable. Facets may include but are not limited to low empathy for others, 
abdication of personal responsibility, habitual projection of blame onto others, persistent belief that 
others are malevolent, or chronic belief in one’s own superiority over others. If personality disturbance 
or disorder appears to be a factor in a threat assessment case, a qualified mental health professional 
should be consulted to help a team understand how it may impact violence concern and potential 
management strategies. 


> Severe mental illness: As previously noted, severe mental illness slightly increases the risk of 
general violence toward others. Psychosis, in particular, can raise concerns depending upon the nature 
of the symptoms; however, psychosis alone is neither necessary nor sufficient to assign a high level of 
concern. Its importance as a risk factor should be connected to how logically linked the symptoms are 
to future violence.**? Major depression, bipolar disorder, schizophrenia or other psychotic disorders can 
all feature psychotic symptoms which may elevate risk. Symptoms of special concern include command 
hallucinations, delusional beliefs of persecution or control, hostility, and grandiosity.“* When these 
symptoms co-occur with additional risk factors, particularly substance abuse or dependence, or a 
confirmed history of violent acts and/or childhood exposure to violence, the concern may increase. 


> History of suicidality: If a person of concern has threatened or attempted suicide in the past, 
this should trouble threat managers. Suicidal and homicidal violence are more closely linked than many 
realize. Evidence of suicidal thoughts is reflective of lost hope, and it may be accompanied by 
acceptance of the consequences for behaving violently toward others. Suicide is often contemplated by 
targeted violence offenders before they decide to attack; instead, they choose to punish those they feel 
drove them to their plight. In a study of 160 active shooter incidents in the United States between 
2000 and 2013, in 64 incidents (40%), the offender committed suicide.” 
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> Organized: Ifa person of concern has a demonstrated ability to organize behavior, regardless of 
any superficial appearance of illogical or incoherent speech or personal presentation, then he is 
potentially able to plan and carry out an act of violence. 


Weapons 

> Firearms and edged weapons: It is easier and more lethal to engage in targeted violence, 
particularly toward multiple targets, with a firearm. Possession of, access to, experience or familiarity 
with weapons are all risk factors because they improve one’s ability to carry out the act. Unfortunately, 
this can be difficult to determine in many cases. Edged weapons and stabbing instruments have been 
successfully used in attacks as well; they are often more accessible than firearms. 


> Explosives: Fascination or experimentation with improvised explosive devices (IEDs) is a risk 
factor. They, too, increase ability to do harm and may also indicate study of past targeted violence 
incidents where IEDs were used or their use was attempted. 


Problematic Behavioral History 

> History of stalking, harassing, threatening, or menacing behavior: This spectrum of behavior 
may indicate low empathy, general disregard for rules and limits, or defiance of authority. These 
behaviors could also represent attempts to or actual breaches of security. If demonstrated as a pattern, 
it may also indicate the person has become habituated to engaging the world in an aggressive manner, 
potentially lowering inhibitions about escalating to violence. This is particularly relevant in the majority 
of mass murders which began with a spousal or family homicide. Several known targeted violence 
offenders engaged in stalking behavior before they engaged in mass violence. 


> History of non-compliance with limits and boundaries: Violations of protective orders or terms 
of probation, flouting of private property lines (in furtherance of harassing activities, for example), and 


disregard for rules at school or work, all fall within this category of behavior. Such a history may bode 
poorly for a threat management strategy that is based on limit-setting, because the person of concern 
may not be willing to comply with limits. 


Social/Environmental 

> Negative family dynamics and support system: An unhealthy family or social peer environment 
can enhance risk. If there is tacit or active endorsement of violence within the home or family sphere, 
this can affect how the person of concern views violence. Similarly, if law-breaking or other negative 
tendencies are the norm ina person’s family sphere or social environment, it can influence behavior in 
negative ways. A toxic family or social peer dynamic could even fuel a person of concern to act. 
Irresponsible and chaotic families can also contribute to casual access to firearms in the home. 


> Isolation: Living in physical or emotional isolation from others, particularly from family and 
friends, deprives the person of concern of emotional support often needed to work through life’s 
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difficulties and challenges. The person has no one to rely upon. This can occur even when the person of 
concern shares a home with family members. 


> Instability: Financial, residential, professional, familial and/or social instability all potentially 
interfere with the person of concern’s ability to become and remain grounded and to feel emotionally 
safe and secure. Instability in these spheres of life can lead to grievance formation, serve as stressors, 
and erode coping mechanisms. 


> Others are concerned: When behaviors exhibited by the person of concern cause fear in others, 
stakeholders should take notice. After all, individuals close to the person of concern are often best 
positioned to observe alarming behaviors. They may not be able to precisely articulate all of the 
behaviors which concern them; they just know they are troubled. 


Warning behaviors 

Unlike risk factors, warning behaviors are dynamic and represent changes in patterns of 
behavior that may be evidence of increasing or accelerating risk.*” When warning behaviors are evident, 
they require a threat management strategy and operational response. They are, for the most part, 
proximal behaviors, occurring more closely in time to a potential act of targeted violence. 


The body of knowledge about warning behaviors is based upon research of and experience with 
attackers and assassins of celebrities, politicians, and other public figures; psychiatric patients who have 
engaged in violence; adolescent mass murderers and school shooters; adult mass murderers; spousal 
homicide perpetrators; workplace violence offenders; and federal judicial threateners and attackers. For 


each “successful” targeted violence offender with any given behavioral past, there are likely many more 
who exhibited similar behaviors, but never attacked. Warning behaviors cannot predict targeted 


violence, but are useful in identifying accelerating risk which should elevate concern. 


Pathway to violence warning behavior 

This set of behaviors refers to the pathway to violence model referenced on pages 24-25. The 
pathway begins with a grievance and proceeds to violent ideation, as discussed on pages 24-25, while 
subsequent steps along the pathway are those articulated here. “Pathway warning behavior” may be 
any behavior that is part of research, planning, preparation, or implementation of an attack.*® 


> Research and planning: Once a person of concern decides that violence should or must be used 
to seek justice for real or perceived wrongs, under most circumstances he must then begin to think and 
plan. The person of concern then considers when, how, and where to offend. He can craft and refine 
his plan by researching methods, the planned target, past offenders, and previous targeted violence 
incidents. The person of concern may consider both practical and symbolic reasons when selecting 
potential targets. As with other steps along the pathway, research and planning need not cease when 
the next step begins; it can and may comingle with other steps. 
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> Preparation: The person of concern may acquire the equipment, skills, and/or any other 
resources necessary to conduct the attack. This can include obtaining weapons and gear as well as 
familiarization of and practice with the weapons. The person may conduct an actual or virtual rehearsal 
of any aspect of the attack (e.g., driving the intended route to the site). It can also include farewell 
writings or other end of life planning, or creation of artifacts meant to be left behind to claim credit and 
explain motive. 


An example of preparation behavior is the case of Mr. A. He came to the attention of a threat 
management team after his passport and a notebook filled with violently themed writings were found in 
a parking lot. Additional investigation determined that he was a danger to others and was actively 
planning to mount a violent assault. At the time of his psychiatric hospitalization related to the above 
circumstances, he was an employee of a retail store. Search warrants were executed at Mr. A’s house 
which revealed numerous journals. Of particular note was a notebook containing almost a daily diary of 
his plans for an assault, seemingly at the store where he worked. After articulating his grievance and 
general disgust for people who shopped at the store, he wrote that in order to prepare for the assault, 
he started bringing a large duffle bag to work so his coworkers would not be alarmed on the day when 
he eventually brought his guns to work in that same bag, in violation of company policy prohibiting 
firearms at the store.© This case vignette could also serve as an example of breach behavior, discussed 
next. 


> Breach: This step involves circumvention of security measures or boundaries at the target 
location. Breach activities can include conducting dry runs, engaging in approach behaviors to include 
stalking, and testing security at the target location. In practice, the BAU has expanded this definition to 
include cyber intrusion behaviors where these breaches may be intended to identify security plans and 
weaknesses, gain protected information about a target, or otherwise further an attack plan via 
unauthorized access to systems. Breach behavior may occur immediately prior to an attack, or earlier. 


> Attack: An offense may involve violence against both preplanned and opportunistically chosen 
targets. Both practical and symbolic acts may occur. The violent offense is the culmination of a highly 
personalized quest for justice which may, ultimately, only be fully understandable to the offender. 


Fixation warning behavior 
Any behavior that indicates an increasing preoccupation with a person or a cause may be 


fixation warning behavior.“ It can be demonstrated by an increased focus on the person or cause, 
and/or an increasingly negative characterization of the same. Further, the frequency and duration of 
the person of concern’s communications about the fixation may significantly increase. Opinions may 


> Case vignettes are provided throughout this guide in order to illustrate points with real-world examples. However, 
all identifying information has been redacted. The facts utilized may be taken out of their full context for 

emphasis and in some instances are amalgams of more than once case. Therefore, vignettes should not be 
considered evidence or presumed to stand alone as the only relevant facts of a case. 
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become more rigid, and speech and actions may appear angrier. Social or occupational deterioration 
can occur as the person loses interest or ability to focus on these aspects of his life. 


Identification warning behavior 

The person may adopt a “pseudo-commando” identity’ or warrior mentality, often with the 
goal of targeting unarmed civilians in a non-military encounter.*? A preoccupation with firearms and a 
desire to use them for revenge may be evident.** The person may view himself as an agent to advance a 
particular cause or belief system.? The practical aspect of identification warning behavior may feature 
an unusual fascination with weapons or other military or law enforcement paraphernalia. This can be 
demonstrated through actual weapons, ammunition or paraphernalia purchases, or through virtual 
activities such as intense preoccupation with and practice on first-person shooter games, or in-depth on- 
line research of weapons.” A psychological aspect of identification may involve physical costuming, 
immersion in aggressive or violent materials, or fantasizing about offending violently. Conversations or 
writings may indicate a desire to copycat and “one up” previous attackers or assassins. 


Novel aggression warning behavior 

This is an act of violence which appears unrelated to any “pathway” behavior and which is 
committed for the first time. The person of concern may be engaging in this behavior in order to test his 
ability to actually engage in a violent act® and it could be thought of as experimental aggression. 
Examples of acts of novel aggression could include animal cruelty, assault, firearm discharge, arson or 
bombing, rehearsed violence with inanimate objects fantasized to be human targets, or even vandalism. 
A threat management team should not discount property crimes as they may be attempts at or first 
steps of a more serious offense or potentially novel aggression. 


Energy burst warning behavior 
This is demonstrated by an increased pace, duration, or range of any noted activities related to a 


potential target, even if the activities themselves seem harmless. These can be overt or stealthy 
behaviors and have been noted to occur usually in the hours, days, or weeks before a targeted violence 
incident.°® For example, a would-be offender may make more frequent trips, errands, purchases, or 
communications as he rushes to finalize his plans and settle his affairs prior to an assault. 


Leakage 

This has been defined as a communication to a third party of intent to do harm to a target 
through an attack.°”? The leaked information to the third party could be overt: “I am going to kill my 
classmates tomorrow;” or it may be less direct: “Don’t come to school tomorrow, but watch the 
news.”°= The BAU takes a somewhat broader view of leakage; expressions, whether or not they are 
communicated to others, which seem to convey thoughts, feelings or intentions to do harm, are all 
considered leakage. For example, creating an animated video depicting a mass shooting would be 
concerning behavior, regardless of whether it is posted or shared with others. Leakage can be readily 
identifiable, self-contained messaging, or more of an accidental or a gradual release of information that 
reveals clues related to the person’s thoughts, planning, or intentions. Leakage may be more common 
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in adolescents than in adults,°? which may be partially due to factors such as increased impulsivity and 
more extensive social media use. 


When leakage in any form is discovered, it should be recognized as such and not dismissed as 
fantasy writing or mere venting; it may be fantasy or it may be an indication of something more serious. 
A full consideration of all facts and circumstances will help threat managers to discern the difference. A 
comparison could be made to suicide notes: before a suicide has occurred, a note referencing suicide 
could be dismissed as acry for help; after the worst has happened, it becomes clear that the note was 
actually a farewell. Leakage can pose the same challenge and therefore all instances of potential 
leakage are worthy of thoughtful consideration. The term legacy token has been used to describe an 
artifact designed to claim credit for a completed targeted violence incident and/or to articulate the 
motivation behind the violence. Attention should be paid to past tense versus present tense in leakage. 
If a statement is in the past tense, it could be a sign the person of concern does not see himself in the 
future, or considers an attack a foregone conclusion, and actually intends to create such a post-attack 
artifact. 


Preventing leakage from becoming a legacy token should be the goal of threat managers. For 
example, Mr. B posted comments on social media about suicide and killing people. His concerned family 
called authorities. When interviewed, he told the police it was all a misunderstanding and that he had 
no plans to hurt anyone or himself. He admitted to having challenges in his social life, but denied any ill 
intentions. He was articulate, cooperative, and polite, telling police that his family tended to worry too 
much. The interaction satisfied investigators, who concluded he did not seem to meet criteria for a 
mental health hold. Mr. B later wrote of feeling profoundly relieved when the investigators left him 
alone, because if they had searched his room that day they would have found evidence of attack 
planning. Less than a month later, after posting videos with similar content, he attacked and killed 
several people on the streets of his community. Some of his pre-attack leakage served to establish a 
legacy of sorts, informing the world of his grievance and sense of injustice. 


Directly communicated threat warning behavior 
This is a statement of intended violence made to the target or to others before the act is 


implemented. The threat may be implicit or explicit, and communicates a wish to harm or kill the target 
or another person(s). This is often the least common among the warning behaviors; as noted elsewhere 
in this publication, a logical chain of events begins to unfold once a threat has been made, which poses 
challenges to the success of a violent plan. Nonetheless, all threats should be taken seriously. 


Approach behavior 
A person of concern’s attempt to gain proximity to a target is considered an approach. Not all 


approaches are problematic, and individuals may have a legitimate reason for being in proximity to the 
target. However, an approach may be intended for nefarious purposes such as pre-attack surveillance. 
The method and means of how an approach is made may be indicative of final acts of preparation, level 
of energy expended, or escalation. Having protective measures in place may not limit, prohibit, or 
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prevent approach behavior. Approach behaviors can be exhibited in activities such as trespass, stalking, 
burglaries, and criminal mischief. 


End of life planning 
These are terminal behaviors which may or may not be closely associated with the desperation 


of last resort thinking. Examples include making a will or documenting last wishes, giving away one’s 
possessions, getting one’s “house in order,” or any other behavior indicating the person of concern may 
be making arrangements to accommodate the end of his life in the near future. 


Last resort warning behavior 
This behavior includes communications or actions indicating increasing desperation or distress, 


or indicating that the person of concern perceives no alternatives to violence. It may include a time or 
violent action imperative. A time imperative is an expressed sense that time is running out or a 
deadline is looming.© A violent action imperative is an expressed sense that nonviolent options have 
evaporated or that violent action is justified.°t Drastic changes in appearance or personal caretaking 
may be present, potentially indicating either preparation to act or mental decompensation, or both. 
Examples have included obtaining large or multiple tattoos with violent imagery and messaging, 
dramatic weight loss, shaving head hair, cessation of hygiene or suddenly appearing unkempt, or a 
significant disruption in sleeping or eating patterns. Additional last resort behaviors demonstrating a 
sense of desperation might include sudden onset of reckless sexual, financial, or other acts that suggest 
a lack of concern for future consequences. 


Indicators of potential imminence 

Risk factors and warning behaviors can also assist in gauging imminence, or how soon violence 
may occur. Just as predicting the occurrence of violence is not possible, the same holds true for 
predicting its timing. However, certain behaviors may indicate a person of high concern may be close to 
acting. 


> Energy burst behavior (see page 34) 


> End of life planning (see page 35) 
> Last resort behavior (see page 36) 


> Sudden cessation of medications or other substance use: A person of high concern who 
normally ingests alcohol, illegal or unconventional substances, or prescription medications, and who 
suddenly stops doing so could be preparing to act. An individual who discontinues his substance usage 
may be attempting to become clear-headed and alert, enabling him to focus on and fully experience a 
violent assault. This differs from a general disinclination to comply with a medication regimen (e.g., 
stopping medication because “I don’t like how it makes me feel”). 


> Sudden withdrawal from life pattern: In some cases, this behavior could include a sudden retreat 
to temporary quarters, unexplained absences from work, failure to appear for appointments that would 
normally be kept, or other signs of withdrawal from life obligations or patterns. This increase in 
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isolation from others could signal that the person of high concern is in final rehearsals (fantasy-based or 
actual) or otherwise making final preparations. A place of privacy in which to work and prepare is often 
needed for a would-be offender to get ready; accordingly, if a person of high concern lives alone, 
withdrawal from pattern may be unnecessary. Similarly, if a juvenile of high concern is allowed absolute 
dominion over his bedroom or personal space in the family home, withdrawal from pattern may also be 
unnecessary because privacy is already assured. 


Triggers and stressors 

A stressor can be anything in the person of concern’s life that causes tension or anxiety. It could 
be an upcoming review at work, an unhappy home environment, chronic pain, or financial distress. 
Stressors can be chronic or acute, mild or severe, obvious or hidden. Identifying the stressors affecting 
the person of concern is an important step in accurately assessing and managing the case. They are 
threat enhancers and, like risk factors and warning behaviors, are not to be weighted uniformly but 
rather individually on a case-by-case basis. Generally, the more stressors that exist in a person of 
concern’s life, the more difficult it will be for him to cope. Ascertaining a person’s reaction to stressors 
is as important as identifying the stressors themselves. Persons of concern with greater resilience in 
response to life’s challenges will cope with them better than a brittle person. It is also important to 
maintain continual awareness, looking out for future stressors and how they may change the 
assessment and management of the case. 


“Triggers” are usually associated with impulsive/reactive violence which is primarily an 
emotional and defensive response to a threat. To say that a specific trigger is responsible for a 
targeted violence incident is to imply the person reacted emotionally and attacked, or “snapped,” which 
is not accurate. Multiple precipitating events can build up over a period of time, raising stress levels 
until the person of concern is susceptible to having a “last straw event.”® Particular attention should be 
paid to recent material, relational, or status losses in any of these categories: family, intimate/peer, 
occupational, and self-image. A brittle person’s reaction to the loss, and whether desperation and 
despair follow, are key points of assessment. Among adolescent and adult mass murderers, significant 
losses happened to many offenders in the hours, days, or weeks leading up to their violent acts.©° 


The threat management team must always include in its assessment the identification of 
potential future events which could push a lower concern case to higher concern. Is the person of 
concern at risk of foreclosure a year down the road? Is his marriage unhappy, creating a risk of divorce 
on the horizon? The team should adopt a forward-thinking approach and attempt to identify upcoming 
stressors and precipitating events. 


Mitigators 

In addition to risk factors, warning behaviors, stressors, and precipitating events, safety 
stakeholders and threat managers should also identify the protective factors present in a person of 
concern’s life. These protective factors, or threat mitigators, may prevent him from thinking seriously 
about, or completing, an act of targeted violence. These variables are also termed stabilizers, buffers 
or inhibitors.°”? General types of stabilizers, buffers and inhibitors include: 
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> Persons, things, or circumstances of sufficient value to the person of concern that reduce the 
likelihood that he may plan and carry out an act of targeted violence 

> Facets of the person himself which enhance his ability to cope with life’s trials 

> External factors which reduce the risk of planned violence, such as in relation to the target or 


physical environment 


Just as with threat enhancing factors, mitigating factors are not to be weighted uniformly but 
rather individually on a case-by-case basis. A treasured relationship with one’s children, for example, 
might have greater weight than a multitude of other mitigators or enhancers. Below are examples of 
threat mitigators commonly evaluated by threat management teams: 


> Pursuit of non-violent, legally and socially-sanctioned methods of conflict resolution: 
Complaints, letters and emails, and habitual initiation of litigation are typically considered threat 


mitigators. These behaviors demonstrate investment in sanctioned methods of seeking redress for 
injustice, which therefore suggests that violence is not considered to be the only alternative. A person 
of concern’s complaints, especially when they are constant, can be cumbersome and annoying to 
address; however, devotion of energy and effort toward leveraging “the system” or communicating 
openly about grievances may indicate the person is more interested in venting, securing financial 
compensation, getting an apology, or simply being acknowledged, rather than planning future violence. 


Howlers 


The BAU occasionally experiences someone who makes repeated threats of violence, 
and yet also pursues non-violent, legally and socially sanctioned methods of conflict 
resolution at the same time, such as continually filing litigation and complaints. Such 


a person may be a “howler” © who could be less likely to have violent intent, in that 


he appears to be invested in lawful, nonviolent processes for obtaining justice. This 
person’s commitment may be to the act of communicating, rather than acting out 
violently. In all cases, however, concern from a threat assessment and management 
perspective should arise when a “howler” has failed to achieve his goals, and legally 
and socially sanctioned methods are exhausted—he could then feel nonviolent 
options have evaporated. 


> Sense of humor: A sense of humor and the ability to laugh, in spite of life’s challenges, is 
considered a mitigator. Laughing reduces negative physiological reactions to stress, and stress-resistant 
people tend to employ humor or spend time with those who do.°? Using humor to cope increases 
resilience. Review of interviews and investigative information in relation to successful and thwarted 
targeted violence incidents generally revealed that the offenders did not tend to use humor to cope 
with challenges. 
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> Positive, realistic goals: Nurturing of future plans and aspirations is a mitigating factor. Goals, 
provided they are realistic and healthy, tend to mitigate violence concern because the person of has 
something positive to work toward. As a more practical matter, the establishment of short- and long- 
term plans and goals suggests the person sees himself existing in the future, which infers the person is 
not considering suicide or mass homicide. 


> Supportive family: At least one family member who supports intervention, sets reasonable 
limits on behavior, and provides healthy structure and a positive influence, can be a threat mitigator. 
The more family members who are capable and willing to fill this supportive role, the better. 


> Healthy social supports: Having a network of law-abiding friends and/or significant others 
around, particularly in daily life, is a mitigator. Such positive and healthy social supports act as 
stabilizing forces in the person’s life, buffering against negative feelings which can lead to a need to act 
out violently. Membership or participation in a church, law-abiding club, or community group can all 
qualify as mitigators. A special pet can also offer healthy support. 


> Positive coping mechanisms: A person of concern who regularly engages in positive activities 
such as exercise, healthy interests, or a hobby may have acquired an increased capacity to deal with 
stress if these are outlets unrelated to a grievance or to violence. As long as these outlets do not involve 
illegal, destructive, or harmful activities, they will generally be considered mitigators. 


> Access and receptiveness to assistance: Access and receptivity to needed assistance generally 
reduce concern because aid can often improve quality of life in various ways. Examples include access to 
mental health or social services, educational or vocational assistance, outreach from family or friends, 
help for physical or medical conditions, financial assistance with basic needs such as food, clothing and 
shelter, and any other needs the person may have. 


> “On the radar”: The mere fact that a person of concern is the focus of an assessment and 
management process, with buy-in by law enforcement and safety stakeholders, is a good starting point. 
Active threat assessment and management allows the team to devise and implement strategies to steer 
the person away from violence. The effectiveness of this mitigator depends heavily on engagement by 
stakeholders and support from the top down in each organization involved in the process. 


Level of concern 

The term “risk assessment” can mean different things within different professions, and is used 
often in various spheres. To physical security specialists, risk equals “threat plus vulnerability.” To 
understand risk of security breach, one must know the threat and identify all vulnerabilities. To 
investigators, a risk assessment may be a less formal calculation of the probability of an undesirable 
event. Threat managers may often be asked to assess someone’s violence risk. In the mental health 
profession, “risk assessment” is a technical term; it is an approach to psychological assessment that 
considers a multitude of factors and behavioral data, usually requiring in-person evaluations in a clinical 
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setting. All relevant data must be in hand in order to assess risk. These are unlikely to be available to 
threat managers faced with a need to quickly assess a rapidly changing situation. In the absence of 
complete information, a “level of concern” assessment can reflect the dynamic nature of warning 
behaviors, changing circumstances, and the effects of intervention.” Someone may be at high risk for 
violence, and yet justify varying levels of concern over time depending on what is being observed. The 
BAU recommends threat management teams think and write in terms of “level of concern,” rather than 
level of risk. The BAU uses concern levels of low, moderate, elevated, and high, with an additional 
rating for potential imminence. (See Appendix A) 


Once the team has gathered all of the available information, to include threat enhancers, threat 
mitigators, precipitating events, and other factors, they can begin to assess a level of concern. No magic 
or mathematical formula exists. Reasonable minds may differ about the importance of one enhancer 
over another or how many mitigators will outweigh a particularly troubling enhancer. This is why threat 
managers work best in teams. The consultative process allows for discussion and consensus. 

Ultimately, a team will arrive at a conclusion on a level of concern and will recommend management 
strategies based upon the particulars of the case. 


Awareness of scrutiny 

Expect behavioral changes in the person of concern if he becomes aware of the threat 
assessment process. Awareness of scrutiny can operate as a mitigator where the person yearns for 
attention or direction and he finds relief in finally being heard. It can be a reality check for the person of 
concern, reminding him that any plans for violent action have now been made much more difficult. Or, 
this awareness can cause the person of concern to engage in impression management, outright 
deception, acceleration of his plan, or to completely “go dark” and hide behaviors that could alarm 


Violence Risk Assessment Tools 


Several violence risk assessment tools are commercially available to assist mental health 
professionals and threat assessors with evaluating the violence potential of a person of concern. 
Actuarial violence risk assessment tools use an equation, formula, or statistical table to arrive at a 
mathematical probability of violence or other outcome. They employ quantified predictor 
variables validated through empirical research to arrive at a risk assessment for violent outcome. 
Tools that do not use a mathematical approach, but rather focus on qualitative data, are structured 
professional judgment (SPJ) tools. This method is based on scientific research, training, and 
experience, and places an emphasis on professional judgment guided by structured assessment 


tools. Threat assessments derived using SPJ generally examine individual enhancing and mitigating 


characteristics, with the goal of devising a management strategy that focuses on violence 
prevention. Finally, unstructured, clinical judgment is also occasionally used but is not the best 
choice for accurate threat assessments. In that approach, an evaluator assesses violence likelihood 
unaided by additional materials. Research has demonstrated this method is less accurate than 
actuarial or SPJ methods. 
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observers. Added attention might generate feelings of persecution in the paranoid. Depending on the 
particulars of a threat management strategy implemented for a person of concern, this awareness may 
be an expected and acceptable circumstance. 


Establishing a baseline of behavior prior to awareness of scrutiny, if possible, may be helpful. 
When change is observed in this baseline behavior, it may be because the person of concern is reacting 
positively or negatively. For example, if the person has been a prolific online poster but goes quiet after 
being talked to about his concerning posts, it raises questions. Is the silence attributable to attempts to 
conceal or has there been a successful deterrent effect? Are there other possible explanations that 
would explain the change, such as ill health, or perhaps a positive life improvement? As with any 
behavior, change means something, and looking at that change and its meaning is important. 


Targeting 


Relationship to grievance 

With enough information, and sometimes logical deduction, potential targets of a person of 
concern can often be identified. Additional targets may be actually or symbolically associated with those 
individuals. Opportunistic victims may be targeted at the time of the offense for any number of reasons, 
including convenience and availability, high visibility and potential for maximum shock value, or 
because a desired target is unavailable. In some cases, it may be difficult or impossible to pinpoint a 
relationship between grievance and targeting, even with the benefit of hindsight. For example, one 
assailant violently offended against the crowd at a suburban movie theater. No associations between 
the offender and the theater, or between the offender and any of the 82 casualties, were ever identified. 


An offender may target locations rather than specific individuals. Choices can include locations 
where activity related to a grievance unfolded (e.g. school, workplace, or a shopping mall where a 
despised class of persons spends time). Other times it is less clear—some offenders have chosen 
locations where they were successful, perhaps for the last time. Sometimes, the target ultimately 
selected may not be a first choice, but rather one which is vulnerable and accessible. One offender 
returned to his old classroom building at his former university and assaulted a class in session with 
multiple firearms. He had no association with any of his victims. However, he had spent much of a 
highly successful undergraduate career in that building before beginning a period of repeated life 
failures. Logically, this targeting may make little sense to the rational observer. However, it apparently 
made sense to him. While he never articulated a grievance or violent ideation toward the students he 
hurt and killed, he had demonstrated a cluster of concerning risk factors and warning behaviors before 
the event. The learning point from a case like this may be that grievance may occasionally not be 
evident, but nevertheless threat managers should focus on an accelerating pattern of warning 
behaviors, how those behaviors may be influenced by risk factors, and whether mitigators are available 
to support the person of concern. 
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Relationship to psychosis 

Psychosis is a severe mental disorder in which both thought and emotion distort reality. It is 
sometimes the driving factor behind targeted violence, but personality disturbances seem to play more 
of a role.” Nevertheless, caution is advised if one assumes that psychotic individuals will not be able to 
organize themselves enough to engage in complex and organized behavior. One early study found 
certain or probable psychosis in two thirds of adult mass murderers, contradicting such an assumption.” 
Recent research suggests that at least 20% of adult mass murderers were severely mentally ill.”? In the 
experience of the BAU, and in the observations of researchers, deeply entrenched delusional beliefs can 
have the effect of focusing and driving pre-attack behaviors and propelling a would-be offender along a 
pathway toward violently offending. 


Although likely representing a minority of cases, psychotic symptoms or disorders can be a 
primary influencer of target selection. For example, Mr. C drove across the country and engaged in 
significant violence at the U.S. Capitol. He killed two sworn U.S. Capitol Police (USCP) personnel, acting 
on his delusional belief that the United States was about to be annihilated by disease and legions of 
cannibals. After surviving the incident, he later disclosed that he went to the Capitol to gain access to 
“the ruby satellite,” a device he said was kept in a Senate safe. As a person with paranoid schizophrenia, 
he was able to plan and carry out cross-country travel, and to engage in successful attack behavior. Mr. 
C believed the satellite was the key to putting a stop to the cannibalism. It had a means of reversing 
time, leading him to believe the deaths he caused were “not permanent.” Although he previously 
communicated his beliefs to others, including multiple governmental agencies, he was unable to secure 
assistance with his mission to protect himself and the public from harm. In his mind, this forced him to 
take action on his own. 


Even if the beliefs articulated by a person of concern seem clearly delusional, it is important to 
assess how capable the person may be of acting out violently or how fixated the person is on resolving a 
grievance. Is the person organized enough to attack? Is the person mobile and does he have access to 
weapons? Mr. Chad a driver’s license, a truck, access to firearms and ammunition, and had traveled 
several times to multiple federal agencies in the Washington, DC, area. 


Family, loved ones, caregivers 

Immediate family members residing in the home with a person of concern, caregivers, or 
anyone close to the person may be possible targets regardless of a seeming absence of grievance 
towards them. Homicidal violence toward such persons, in tandem with a larger attack, has occurred in 
too many cases to be overlooked. Motives for these pre-attack homicides range from animosity toward 
caregivers to wanting to shield them from the aftermath and stigma of the larger attack. 


For example, Mr. D experienced lifelong, significant developmental challenges including 
communication and sensory difficulties and social-emotional problems. He became preoccupied with 
violence in elementary school, as demonstrated by graphic writings which went largely unaddressed. 
Crippling anxiety resulted in his placement in homebound education status in middle school. A child 
psychiatrist evaluated him, recommending intensive educational and therapeutic supports and expert 
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consultation; these recommendations went largely unheeded. His mother accommodated her son’s 
resistance to medication, therapy and educational support. Mr. D spiraled into a life of isolation with his 
mother. He became fixated on mass murder, finding validation and support for this obsession from an 
online pseudo-community of mass murder enthusiasts. Rather than following the recommended care 
and treatment plan that may have helped Mr. D learn to adjust to the world, his mother created a world 
that adjusted to him. Her primary strategy was one of accommodation and appeasement, facilitated by 
a belief that she knew her son better than anyone, including the psychiatrist. Although no one but the 
offender was responsible for his crimes, opportunities for intervention were lost. The offender first 
murdered his mother, and went on to kill 20 children and six adults at a local elementary school. 


Information gathering 

Once a person of concern has been identified, some level of threat assessment, either triage or 
a 360° assessment, is the next step in determining whether the person might be on a trajectory toward 
targeted violence. Threat assessment is a highly detailed and nuanced process, often made extremely 
difficult by sparsely available information. One of the most important tasks in the process is gathering 
detailed information about a person of concern, the situation, the setting, and to a degree, the target. 
Both current and historical information is needed to form a complete picture. This section provides 
insight into the kinds of information assessors may consider seeking. Although there is no such thing as 
a global checklist to be followed in all cases, this section can serve as a general guide when initially 
looking at a new case. Once a picture of the person of concern begins to clarify, then specific 
information gathering decisions should be made. Each matter is highly unique for the simple reason 
that each human being is highly unique. Information gathering preferences must be determined for 
each case anew, taking into account the particular case under consideration. 


Threat assessment teams will also have to accept that it will be the rare case indeed in which all 
desired information is available and no questions are left unanswered. Knowledge gaps are an 
unfortunate reality of threat assessment. It is critically important to gather as much information as 
possible, although sometimes information will simply not be available by any means. Sometimes it will 
be unavailable due to legal or logistical impediments, but generally speaking there is very often a great 
deal of information which can be accumulated in furtherance of truly understanding what is happening 
with a person of concern. Preliminary assessments can sometimes be offered pending development of 
additional information. 


Assessments must be based upon fact, and if this caution is not heeded they can be distorted by 
assumption, speculation, and guess work. Patience is often required while research and investigation 
are conducted to fill in any data gaps. Inevitably, however, these gaps will occur. When they do, 
assessors must do the best they can without, to the extent possible, making assumptions. Partial or 
preliminary assessments should include caveats that indicate the information is incomplete. All should 
be aware of the “silo effect;”’4 data gaps may result when stakeholders do not share their information 
with one another. For example, if a law enforcement entity involved in a case does not share its 
information regarding the person of concern with the corresponding mental health institution, 
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important information could be missing when a critical mental health evaluation takes place, which 
could in turn result in less effective treatment. 


When a question is asked and cannot be answered, for example if mental health records at three 
hospitals are known to exist but are not available through consent or other lawful means, then a threat 
assessment team knows and understands it has a significant information gap in the case. This is a known 
unknown—the team is aware that it does not have a piece of information. The advantage here is that 
the team knows about the gap and can try to address it through other means (e.g., interviews of 
past associates or loved ones could reveal facts and observations that might fill in that gap). 


Another important gap is the unknown unknown—a facet of the case which the team is not 
even aware exists. An example would be when a threat management team knows a person of concern 
had been hospitalized for psychiatric care in the local community, but had no idea he had also been 
hospitalized twice more in the past, in distant states. The facts and circumstances of those treatment 
periods could be important. Did episodes of violent or threatening conduct lead to them? Were family 
members involved with the commitment process and therefore are potential allies in the current 
situation? Thorough information gathering greatly reduces the risk of unknown unknowns. 


Gathering information could be somewhat intrusive into a person of concern’s life and therefore 
a respectful approach is a must. Collecting some kinds of information may also require legal process or 
consent, though many privacy laws allow for disclosure of records when necessary to avert imminent 
violence. Although finding information is not always easy, it is also unwise to rely upon superficial data, 
to intentionally decide not to fill information gaps, or to disengage and do nothing. Therefore, a robust 
but respectful information gathering stage of inquiry is recommended before a threat assessment is 
conducted. It is important to put the behavior of concern into the greater context of the person’s life by 
gathering information. Striking a balance between privacy and public safety is essential. However, a 
level of intrusiveness may sometimes be necessary in order to be thorough, accurate and fair. 


The following behaviorally relevant information has been found helpful in targeted violence 
threat assessment, and can be gathered from interviews, open source research and records collection. 
It is by no means a comprehensive list meant to identify every potential source of information. Below, 
in “Data sources,” information types and sources are identified. Next in “Relevance of data,” further 
explanation about the relevance of these sources is offered. Threat assessors are cautioned against a 
tendency to focus only on details which support concern for violence rather than all details which 
include threat mitigators (See pages 21-23, “Bias”). 
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Data sources 
> Law enforcement and military 


[e) 


O 


Criminal history and National Crime Information Center (NCIC) offline searches,° emergency 
and non-emergency calls for service related to the person of concern or his residence, non- 
arrest police reports 

Military service records, if any 


> Education and workplace 


o School records, including attendance, academic performance, disciplinary or counseling 
records and notes, writing or other expressive class assignments, interviews with teachers 
and other staff who personally interacted with or observed the person of concern, or any 
other information relevant to behavior 

o Employment and personnel records, to include attendance, disciplinary or counseling 
records, interviews with supervisors and coworkers, performance records, or any other 
information relevant to behavior 

> Medical and mental health 

o Medical and mental health records, including notes by care providers 

o Interactions with social services agencies 

o Substance use or abuse, to include doctor-prescribed medications, over-the-counter 
medications and supplements, recreational substance use including alcohol and illicit drugs, 
and unconventional substances (e.g., bath salts) 

oO Participation in substance treatment, behavioral treatment or other rehabilitation programs 


> Expressions 


Oo 


[e) 


[e) 


Correspondence, particularly to/from any identified potential victims, to include electronic 
mail messages, letters, notes, poems, song lyrics, text messages, or graffiti 

Journals, notes, other writings regarding topics of interest to the person of concern, 
especially including those which raise concerns about potential violence, although safety 
stakeholders are reminded that evidence of mitigators can also be found in writings 

All online presence and activity, to include social media, blogging, research, business or 
professional activity 


> Life and relationships 


Nature and quality of family and social relationships 

Descriptions of interactions with others, both when the person of concern is satisfied and 
dissatisfied 

Living situation, to include cohabitants and the nature/quality of relationships with them, 
nature of residence and upkeep, whether residence is also used for other purposes 
Habits, routines, opinions and views of the person of concern 

Memberships, religious views and practice if any, hobbies and pastimes 


© Criminal history and NCIC offline information is typically available only to law enforcement agencies. Therefore, 
sharing of specifics from such reports with other members of a threat assessment team may be limited. 
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o Movies, television shows, video games, books and magazines, including how much time and 
energy is devoted to particular favorites 
o Financial situation and status, as evidenced by purchasing patterns, income and losses 
> Other 
o Personal electronic devices (e.g., computers, phones, game consoles, cameras, flash drives) 
o Weapons access and familiarity, attempts to access weapons, target practice and shooting 
club membership, concealed carry permits and ownership registration 


Relevance of data 
> Criminal history, NCIC offline searches, non-arrest law enforcement agency reports: A criminal 
history provides insight into a person’s level of respect for laws, boundaries and limits, as well as his 
comfort level with negative behaviors. It may also offer insight into what a person considers to be taboo 
versus acceptable behavior. Interactions with law enforcement may offer insight into whether a person 
respects and complies with authority, and his attitude toward law enforcement. Contacts that did not 
necessarily result in arrest can be excellent sources of this insight, as well. Past recorded contacts may 
provide abundant direction regarding behavior management. As the best indicator of future behavior is 
often past behavior, it is important to know whether a person has engaged in past violence, and if so, 
what kind of violence. Defensive violence in a bar fight is much different from walking up to a coworker 
and punching him in the face. Not all violence may appear in a criminal history report, so it is important 
to ask those individuals who know the person well if he has exhibited any violent behavior in the past. 
Past violent behavior may also be documented in non-arrest related police reports and school records. 
Criminal investigation reports will usually detail behaviors which can only be inferred by a "rap sheet.” 


> Military records: Military records provide insight into a person’s experience with firearms, 
offensive/defensive tactics, and other special skills relevant to the ability to plan and carry out an act of 
targeted violence. As personnel files, they can provide data related to training and certifications; 
commendations; mental and physical health diagnoses, treatment and care; leadership; ability to obey 
authority; disciplinary issues; discharge summaries; and other behavior-rich details. 


> School or employment records: These records, while sometimes shielded from threat 
assessment team review by privacy considerations, can supply many kinds of relevant information. 
Patterns of emotional decline or improvement over time can be observed via performance, attendance, 
or behavioral changes if records are available for a lengthy period. Whether or not the school or job has 
a positive effect on the person, or if the job or school is a source of a grievance, may be detected. Clues 
to targeting, research and planning, preparation, emotional leakage, and more could potentially be 
found in such records. 
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> Medical history: These records can provide 
insight into injuries, chronic and acute illness, pain, Head Trauma 
treatment successes and failures, specialist referrals and Although not directly correlated with predatory 


more. All of these can represent enhancers and violence, a history of head injury may be of 


mitigators for consideration during the assessment interest becadeeit dass correlate with eaneral 


process. Frequency of medical consultation and : F d 
violence risk factors, such as increased 


treatment can also offer clues to a person’s level of : Reteene ‘ : 
impulsivity, increased alcohol use, relationship 


receptivity to assistance and intervention. Regarding ietability, ofothers: The BAW hasexperienced 


medication history, dosages, route of ingestion ; F a . 
¥, BES, 8 : cases in which head injury raises concern for 


frequency, side effects, and drug interactions could all 


impulsive or reactive violence in persons of 


affect behavior, emotions, and mental processing and 
concern. For example, a person of concern 


may increase paranoid or depressed thoughts which may with a history of serious head injuries and 


subsequently lead to violent action. For medications ; ‘ 
demonstrated impulse control issues may not 


prescribed to help with an existing mental or emotional be-ab increasecinse farglannineanredatany 


disorder, it is important to note whether the person is attack because of the head injury history, but 


complying with the prescription. A general medical he-could beatincrassed visitor impulewely 


doctor or a psychiatrist may be consulted where hapaving Sianser awhenduteraciians deraecur. 


necessary for assistance with understanding the effects 


substances may have on the person of concern’s 
behavior and thought processes. 


> Mental health history and diagnosis: Information about a person’s mental health, declines and 
improvements (and what may have precipitated them), suicidal and/or homicidal ideation, medications, 
specific treatments that were successful and unsuccessful, notes about the person of concern’s feelings 
about treatment, and prognosis for the future are all potentially revealed in these records. Treatment 
successes or failures may inform an assessment and assist in identifying effective threat management 


strategies. 
> Expressions: Persons of concern may provide clues about their grievances in their expressions. 


Identification of a grievance can help pinpoint potential fixations. It can also offer clues about what 
threat management strategies might be successful, in that the grievance could be a solvable, or at least 
reducible, problem. If threat managers are able to understand what thoughts and feelings are driving 
the person of concern, they are that much closer to figuring out how to prevent violence from occurring. 
A person of concern may express that violence is an, or perhaps the, acceptable method of conflict 
resolution. Expressed violent ideations can also offer hints about targeting, means of potential attack, or 
other vital clues to the thoughts and plans of a person of concern. Threat managers should explore past 
or present suicidality and statements of hopelessness (“I see no way out”), as well as homicidal 

ideation. Social media platforms should be examined to identify the content, frequency, and type of 
social media use by the person of concern (See pages 49-50 “Social media and the Internet”). 
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> Life and relationships: Details of living situation and life pattern are important. They may help 
identify others who could provide stability and support, or who could make the situation worse. If the 
person of concern lives alone, that privacy may afford isolation needed to plan and prepare to engage in 
violence. Residential instability is a stressor that can add to a person’s burden and be a drain on coping 
skills. An unstable residential history could be representative of unstable personal relationships, 
financial stressors, unresolved mental health concerns, or other problems. Life pattern is also important. 
First, it will help threat managers know when the person begins to deviate or withdraw from that 
pattern. Additionally, knowledge of eating, sleeping, and social interaction patterns are helpful for 
assessing general stability and physical and mental well-being. The person of concern’s financial 
resources should be taken into consideration because they may affect the ability to carry out a plan of 
targeted violence. Access to money increases the ability to purchase weapons and other gear needed 
for an assault, to travel, or to fund other logistical needs. Access to money could also be used ina 
positive manner, for example to finance hobbies or positive interests, to spend time with loved ones, to 
gain independence from toxic influences, or simply to enjoy life. Additionally, financial losses and 
hardships may be significant stressors in a person’s life and should be considered in assessing current 
and future violence concern. 


> Preoccupation with targeted violence: Many targeted violence offenders have demonstrated a 
preoccupation with past incidents. Quoting from other offenders, keeping statistics about notorious 
events, and a general captivation with violence, particularly targeted violence, all suggest a 
preoccupation. It may also reveal clues about potential assault methods if the person of concern has a 
particular interest in several events with commonalities between them. For example, if a person of 
concern is most interested in previous offenders who used or tried to use improvised explosive devices, 
then it could be that the person of concern is interested in doing the same thing. 


> Weapon access and familiarity: This aspect of assessment directly relates to capacity to engage 
in targeted violence. 


> Other: Personal electronic devices (e.g., computers, phones, game consoles, cameras, flash 
drives) may all hold information specifically relevant to threat assessment, such as evidence of research, 
planning and preparation, leakage, identification of grievances and violent ideations, and more. 


Interviews 

Interviews of the person of concern and those who know him can provide a wealth of 
information regarding the person and his motivations, plans, and risk for violence. Family members, co- 
workers, employers, friends, students attending the same educational institution, and others could all 
potentially assist threat managers who are engaged on a case. Traditional “crime-solving” interviews 
can be somewhat ineffective in identifying violence concern or vulnerability to violence risk, particularly 
where no crime has been committed. As with any investigative interview, however, interviewees may 
leave out crucial information because they believe the information is not important, is embarrassing, or 
can get them into trouble. The goal of many threat assessment interviews is to obtain a complete “360 
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degree,” or a complete biological, psychological, and social portrait of the person. The information 


presented in this guide can help with appropriately structuring these interviews. 


Records 


Records can be a source of valuable information about current and past behaviors exhibited by a 


person of concern. Threat managers should collect as many relevant records as possible and should 


have knowledge of privacy laws and confidentiality 
protections in order to properly obtain them. Like all 
case information, they should be properly protected 
once obtained. 


Open source 

Open source searches for the person of 
concern can identify additional family members and 
associates, past residences, current roommates, 
financial/employment information, firearm 
ownership, vehicle information, and electronic mail 
(email) addresses used by the person. Social media 
reviews can reveal current and past activity, assist in 
identifying a grievance, and identify additional 
friends and acquaintances, travel plans, interests or 
hobbies, and more. 


Social media and the internet 

The importance of the role of social media in 
threat assessment and management cannot be 
overstated. It saturates daily life for many people 
during all waking hours. Social media can be 
accessed on smart phones, computers and 
televisions, and now by wearable technology. Live 
internet streaming is as much a part of everyday life 
for some as buying groceries. It is imperative that 
threat management teams have on staff, or have 
access to, someone with cyber skills and social media 
acumen. Some obvious examples of current social 
media options which often come up in threat 
assessment cases include: Facebook, Twitter, 


Privacy Laws 


Understanding the laws protecting privacy 
rights of individuals is important for threat 
management teams. The Health Insurance 
Portability and Accountability Act (HIPAA), 
the Federal Educational Rights and Privacy 
Act (FERPA), and federal and state privacy 
acts are primary examples. They can be 
complex and time consuming to digest, but 
doing so is amust. A common perception 
appears to be that record holders must 
choose between blowing the whistle and 
risking a lawsuit, or remaining silent and 
risking a disaster. The reality is that 
privacy laws can comfortably 
accommodate both interests; they limit, 
but do not prohibit, disclosure of 
information to law enforcement and threat 
assessment teams. For example, 
exceptions often allow disclosure of 
protected information when necessary to 
prevent or lessen a serious and imminent 
threat to health or safety. Additionally, 


stakeholders should remember a person of 


concern always has the option of 
consenting to disclosure. Teams should 
maintain a source of expertise regarding 
applicable privacy laws. 


YouTube and Google+; new services are created every week and may be more generation-specific. 


Weblog (“blog”) and commerce sites may also reveal information about a person of concern. A 


complete list of options would likely be impossible to catalog as the possibilities seem nearly infinite and 


are ever-changing. For persons of concern in any age group, it may be advisable to consult with 


someone in an equivalent age, social sphere, and community, for insight into which social media 
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platforms may be in use. However this task is accomplished, it is important that it is accomplished. 
Social media offers an often unparalleled view into the thoughts, feelings, plans and intentions of a 
person of concern. Social media leakage may initially be unknown to investigators, particularly where 
pseudonyms are used in place of a person’s true name. However, once it is located it can be a very 
effective source of information regarding the person’s mindset and future plans. Social media review 
should begin as soon as a case is opened, and continue until concerns are abated. 


A study of targeted violence incidents at schools revealed that in over 75% of the cases studied 
at least one person had information that the offense was being planned. Most were peers, such as a 
friend, a schoolmate, or a sibling.”> Some peers knew about the plan because the offender “leaked” it. 
Leakage on social media could take the form of writings, images, videos, and even “likes.” An example 
of social media leakage occurred in a European case. Hours before a 2011 assault on a youth camp, the 
offender posted a video online which appeared to advocate violence toward specific religious and 
political groups. About 90 minutes before his offense, he posted a 1,500+ page “manifesto” online, 
describing two years of preparation for violence. It is worth noting that neither of these posts included 
a direct threat. 


Online, one can readily find support and validation for even the most violent ideas and plans; for 
those who wish to remain anonymous the internet can offer that protection. The dominance of the 


internet and online life has led to the evolution of a “pronoid pseudocommunity””® 


of people who are 
fascinated with targeted violence incidents or even endorse them. Pronoia is a converse of paranoia: a 
delusional belief that others are saying good things about the pronoid person.”” In the emotional safety 
of this virtual environment, the person of concern finds a home of sorts in a pseudocommunity—he can 
discover mutual agreement and encouragement for his feelings about himself, others, his grievance and 
more, no matter how abhorrent those ideas may be. Attachments formed within the pseudocommunity 


can replace real world ones, particularly when online friends offer validation when “real” people refuse 
to do so. This can foster increased senses of grandiosity and power, both of which may contribute to a 


sense of entitlement to engage in violence. 


Another concept related to online activity is disinhibition, which is a lack of restraint 
demonstrated by disregard for social norms and poor ability to assess risk. Disinhibited individuals may 
say and do things online they would not normally do when others are able to observe them. They can 
easily research and view anything online without consequence. The internet is a place of infinite links, 
where one can burrow down through multiple sites by clicking on appealing topic after topic in a sort of 
“rabbit hole” effect. Some individuals may be trolling the internet and viewing violent material simply 
for entertainment. Some may be searching for a satisfying fantasy. A few may be looking for ideas for a 
plan of violence. Social media and the internet provide ease of access which can in turn accelerate 
violent ideation into planning or action. 
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Chapter 4 Management: The Prevention Plan 


The recommendations contained in this chapter derive from the experience and perspective of 
the BAU and the symposium participants. They include passive and active strategies geared toward 
preventing violence and contain many valuable and actionable suggestions for threat managers. 
Although the intake and assessment processes are generally standardized, management plans should be 
unique in most instances. 


Once a level of concern has been assessed in a case, the next step is management. Recognizing 
a threat or a concern for violence is only the beginning; doing something about it is what may change 
the course of events. Threat management is a carefully planned intervention or series of interventions 
focused around the person of concern, potential targets, the situation and/or the setting in which 
violence could occur. Effecting change with regard to one or more of these domains may change the 
course of events ina positive way. In this chapter, threat management is addressed from various 
standpoints, including identifying several threat management techniques which have proven successful. 


Unfortunately, increasingly sparse resources and a high volume of service calls make it difficult 
for law enforcement agencies to expand their scope beyond enforcing criminal laws. Most are 
stretched thin as it is. Diverting time and energy away from criminal behavior to focus on preventing a 
possible event may not be the easiest leadership decision to make. It is sometimes a necessary one, 
however. Threat management is about diverting direction of interest, diminishing dangerous and 
concerning behaviors, and altering a trajectory toward targeted violence. 


Safety and caretaking 

Protecting public safety and caring for persons of concern are heavily intertwined. Successful 
management strategies embrace this reality; focusing on one of these aspects at the expense of the 
other is potentially hazardous. Threat management teams exist primarily to protect public safety. This 
is accomplished in large part through interventions intended to improve a person of concern’s well- 
being, always keeping in mind that public safety is the ultimate goal. All recommendations for action by 
the threat management team, even arrest or hospitalization, should be implemented in a respectful 
manner. Stakeholders should ensure the person’s dignity is maintained; perceived loss of dignity may 
only fuel or create a new grievance. Potential consequences of planned interventions should always be 
considered before action is taken. Public safety may be enhanced when the person’s well-being is 
improved and the grievance is addressed; both of these strategies attempt to prevent violence at its 
root. 


Assumption of responsibility 

Once a person of concern is identified, it is important that stakeholders take ownership of the 
case. The threat management team will be comprised of representatives from various entities; these 
entities are responsible for ultimate management. See Chapter 5 for recommendations regarding team 
logistics and functioning. 
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Threat management can be short-term or long-term, with an open case ranging in duration from 
days to years. Some cases that may initially seem to be short-term may ultimately turn out to be long- 
term. They may appear to be resolved, only to require reassessment at a later date as new facts and 
circumstances emerge. When assuming responsibility for a long-term case, a team could end up feeling 
exhausted, overwhelmed and desensitized. After a management plan has been initiated, the 
responsibility of the team and its members, and responsible stakeholders, does not stop. The plan must 
be seen through, continually reassessed and adjusted as necessary. If a person of concern moves to 
another jurisdiction, the case and all relevant information should be transferred in a responsible manner; 
thorough transfer briefings and follow-up are recommended. 


Accurate and effective communication to determine ownership and responsibility will serve all 
involved teams and organizations well. However, sharing information for the sole purpose of ‘passing 
the buck’ is not effective threat management, and may even constitute irresponsible handling of the 
case. An entity attempting to pass responsibility for a case may be the most logically responsible 
whether it wants to be or not. It could be dangerous to hand off a case without ensuring the receiving 
entity understands the gravity of the situation and everything that has transpired up to the point of 
transfer. For example, one community threat assessment team has a practice which ensures seamless 
transition of cases within its region. If the school district team is managing a student of concern who 
leaves the school system, that case automatically transfers to the community’s adult threat assessment 
team for continued assessment and management. If the person of concern leaves the jurisdiction, the 
case is responsibly transferred to the appropriate threat assessment team or law enforcement agency in 
the new jurisdiction. 


Another potential pitfall is concluding that a case is over when the person of concern is fired, 
expelled, or otherwise removed from the immediate situation. This is simply not so. There may be little 
to stop a fired employee from returning to the work site, going to the residence of a targeted coworker, 
or appearing at a public venue favored by other employees. An expelled former student can easily 
return to campus, to the home of another student or staff member, or to some other location where 
targets may be found. Further, removing a person of concern from the field of view in this way creates a 
blind spot. Once threat managers’ optics on the person is lost, there is no way to know if the person is 
escalating. While sometimes necessary, dismissal from the setting is not a threat management strategy 
in itself. Ironically, once a person is barred from a place, more planning for safety is often needed or 
strongly recommended. 


A notable case in which removal from the setting did not prevent violence was that of Student E. 
He was a troubled young man attending high school and he exhibited many risk factors and warning 
signs concerning his environment and upbringing, family, mental health, and education. After he began 
demonstrating concerning behaviors, school administrators referred him for homeschooling. He 
murdered his grandfather and his grandfather’s companion before returning to school and killing seven 
people and injuring five others. He committed suicide before he could be apprehended by the police. 
Unfortunately, removing Student E from the school setting did not prevent him from offending. It did, 
however, shield his behaviors from visibility, further his isolation and estrangement from peers and 
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caring adults, and offer him enhanced free time and privacy in which to plan and initiate acts of targeted 
violence. 


In a workplace example, Mr. F was hired and quickly became known as a problem employee. He 
had interpersonal conflicts with everyone with whom he worked and always blamed others for his 
problems; his coworkers were very uncomfortable around him and felt threatened. Mr. F was 
dismissed less than a year after he was hired because of volatile behavior. He yelled at co-workers after 
learning of his firing and refused to leave the building; police had to escort him out. The company 
provided security to the staffers for a time after the incident, and directed them to call 9-1-1 if he ever 
returned to the property. Mr. F filed numerous legal complaints against his employer, all of which were 
ultimately dismissed based on lack of evidence. More than two years after he was fired, Mr. F took 
revenge by shooting to death two former colleagues and hours later took his own life. In his suicide 
note he wrote that he was influenced and provoked by other shooters who had made the news in 
previous months. 


When feasible, organizations, safety stakeholders, and threat management teams should 
consider maintaining access to the person of concern and retaining an optic on his behavior before and 
after expulsion, termination of employment, or other form of removal from the environment. 
Otherwise, a blind spot could be created, limiting a team’s ability to effectively gather intelligence and 
take the appropriate actions necessary to prevent an act of violence. 


Prevention, not prediction 

Threat managers are not psychics and they cannot predict the future. Just as a targeted 
violence event cannot be predicted, the perfect threat management solution cannot be foreseen. The 
threat assessment and threat management relationship is one of continuous reassessment and 
modification. If one management strategy is not working as planned, the next steps are to reassess, 
modify the plan, and try again. Rarely is there only one solution for each case. The alternative is to do 
nothing, fail to adjust, and wait to see what happens. Unfortunately, making such a choice may only 
allow a bad situation to become worse. 


When an act of targeted violence occurs, hindsight becomes easy. Once an act of violence has 
been perpetrated, the offender’s situation, grievance, and violent ideation can seem obvious. Without 
the benefit of hindsight, however, threat managers cannot know at what point an intervention would 
have been effective. Prevention, therefore, is best approached in a holistic way. Thinking about the 
person of concern, the target, the situation and the setting in their totality increases the odds of 
preventing tragedy. To use an example from medicine, a cardiologist can identify patients at high risk 
for a cardiac event. The doctor cannot, however, predict which particular patient will have a heart 
attack. He knows the risk factors—high blood pressure, high cholesterol, obesity, family history, poor 
diet, and no exercise—and can help the patient manage these. However, he cannot know which patient 
would have had a heart attack without management of risk factors. This is prevention without 
prediction. A similar principle applies in threat assessment and management. Effecting thoughtful and 
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well-planned changes can stabilize a volatile situation and reduce violence concern in the absence of an 
ability to foretell the future. 


Management spectrum options 

Multiple, concurrent management strategies are almost always appropriate. One suggestion is 
to identify potential strategies from each discipline represented on the threat management team; each 
member should look to his or her own resources to evaluate what can be leveraged toward managing 
the case. Signs of deterioration can be viewed as opportunities for intervention. If mental 
decompensation seems to be happening, is commitment or at least a mental health violence risk 
assessment possible? When a firearm is possessed by a juvenile, is juvenile prosecution an option? 


There is no “one size fits all” approach to threat management. Instead, a threat management 
team should focus on case-specific, creative solutions based upon communication, partnerships, and 
leveraging of resources. Flexibility is the key. Options include, but are not limited to, the following: 


Person of concern 

> Take no further action at this time: This is a deliberate threat management option based upon 
articulable facts that justify the decision to take no action. This decision should rest on an assessment 
that the person of concern poses minimal or no risk at that particular time. This is not a strategy or 
solution for not knowing how to proceed. 


In one case example, Student G wrote an assigned class essay about “my future career,” 
detailing an aspiration to become an assassin. The case received attention due to a zero tolerance 
policy which prohibited violently themed material. A review of the essay strongly suggested it was 
purely fanciful in nature. Further, exploration of the student’s personal history revealed no threat 
enhancers and many mitigators. When interviewed, Student G responded with surprise and annoyance 
that his essay was taken seriously, which was consistent with this student’s normal attitude that life 
should not be taken too seriously. The BAU recommended no further action be taken on the case at 
that time. 


> Watch and wait: A watch and wait strategy is used when someone may be a person of concern, 
but insufficient information is available upon which to base a complete assessment or implement more 
active management strategies. Watch and wait can include observation of the person of concern’s 
online and in-person behaviors. This option can be implemented in conjunction with any threat 
management plan as a way to continuously gather information and observe changes in behavior. ”° 


In one case example, Mr. H had a long history of harassing behavior and set his sights on the 
CEO of a large company. Mr. H authored a steady stream of harassing emails and letters to the CEO, 
demanding money in exchange for ideas he claimed were stolen from him. The BAU assessed Mr. H 
posed a low level of concern for targeted violence. Wishing the harassment to stop, the CEO requested 
that law enforcement interview and admonish Mr. H. The BAU’s opinion was that an admonishment 
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would likely be ineffective; from a threat management perspective such an admonishment might 
elevate Mr. H’s grievance with the company and could cause him to believe that the FBI was in collusion 
with the company against him. Unless and until Mr. H’s communications suggested imminence such as 
evaporating patience or that his opportunity to attack was narrowing, the BAU recommended Mr. H be 
allowed to vent, and that stakeholders should wait to see if any escalation occurred. 


In another example, Mr. | was fired from his job, lost a child custody dispute, and had been 
arrested twice within six months for non-violent offenses. Police found notes which he kept on current 
events including a recent act of targeted violence. During an interview with law enforcement, Mr. | was 
very inquisitive and questioned why police were making something out of nothing. Results of a search 
warrant on Mr. l’s phone appeared to corroborate his explanation that he was interested in current 
events rather than conducting research and attack planning. Mr. | had begun searching for new 
employment and filed an appeal of the child custody decision. A preliminary assessment yielded no 
evidence of a grievance, warning behaviors, an identified target, or any suggestion of time or violent 
action imperatives. The BAU assessed that Mr. | posed a low level of concern for targeted violence, and 
recommended passive monitoring, including review of publically-accessible social media accounts to 
remain aware of any changes or escalation in his communications. 


> Third-party monitoring: Third party monitoring involves identifying and enlisting a reliable and 
discreet individual to assist threat managers. This third party could be a family member, friend, co- 
worker, probation officer, or anyone who has regular contact with the person of concern. Ideally this 
individual will act as a supportive listener who discourages negative or violent thoughts and who acts as 
a positive influence. An ideal third party monitor is liked, trusted, and cognizant of the person’s ups and 
downs. A third-party monitor is someone who will not reveal threat managers’ interest unless agreed- 
upon, and will keep threat managers apprised of developments with the person of concern. 


For example, Mr. J had a lengthy criminal history and used social media to post graphic photos 
of mutilated and dismembered bodies, as well as information regarding targeted violence and mass 
murder. He also had a long history of substance abuse as well as mental illness. When his parental 
rights were terminated, he developed a grievance against various persons involved in this decision. In 
addition to other measures, the BAU recommended the introduction of a third party monitor. Due to 
Mr. J’s reclusive nature, he had very few friends or family members with whom he was close. He did, 
however, have rapport with a neighbor who was deemed to be responsible and discreet. This neighbor 
was recruited to gently monitor Mr. J for signs of escalation or changes in behavior, allowing threat 
managers to unobtrusively retain awareness. 


> Third-party intervention: In this variation, the third-party monitor is also positioned, and safely 
able, to provide more active assistance in managing the person of concern by various means. Examples 
may include helping to ensure the person gets to outpatient treatment appointments or actively 
discouraging violent thinking or planning. 
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Student K was an isolated 15-year-old who was arrested for making threats. He attempted to 
purchase an assault weapon and body armor online, and expressed an interest in violent groups. He 
developed a grievance against the police who arrested him and talked about attacking them. Student 
K’s adoptive mother did not take his behavior seriously and his adoptive father was largely absent. The 
BAU recommended a third party intervention strategy, with a particular emphasis on caretaking, to try 
to manage Student K away from purchasing weapons and ammunition. He liked and respected a track 
coach at his high school, who was willing to engage with Student K, discourage him from violence, and 
serve as a supportive listener. The coach invited Student K to work with the track team as an assistant, 
giving him an outlet for his time and the opportunity to be a productive member of the school 
community. This management technique worked extremely well. Student K felt someone was finally 
listening to and caring for him. He gradually became disinterested in retaliation against the police and 
more focused on a positive future. 


> Direct interview: An interview with the person of concern can be structured in various ways to 
serve different purposes. Goals of an interview could include: 


o Gathering information about grievance, motivations, plans, the identity of additional interview 
contacts, and more 

Redirecting the person of concern away from any known targets and away from violence 
Offering appropriate assistance 

Delivering an admonishment against further negative behaviors 

Serving as an effective deterrent, in that it reveals to the person that his behavior has been 
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noticed 


Threat managers should be mindful that the interview could also cause the person of concern to 
begin hiding his behaviors. Exit interviews to gather information following terminations or expulsions 
can be particularly effective counterbalancing techniques to offset the loss of visibility once the person is 
removed from the immediate environment. Like any management technique, direct contact with the 
person of concern must always be carefully considered in terms of costs and benefits, particularly risk of 
aggravating the situation. 


Mr. L was an employee for a large international company who was terminated for sexual 
harassment and inappropriate emails. Mr. L respected a court’s order prohibiting further contact with 
the victim of his harassment and prohibiting physical approach to the company’s property. Six months 
later, he began emailing another employee to complain about the victim, who filed a sexual harassment 
civil suit. He also complained about the company’s unfairness in terminating him and emailed the 
employee a photograph of a firearm. The company became concerned that Mr. L might be considering 
an act of targeted violence. He had no known history of violence but did have an alcohol dependence 
issue. The BAU recommended an interview strategy of trying to convince him to relinquish his firearms, 
to seek psychological counseling, and to attend treatment for alcohol dependence; alcohol use was 
suspected of exacerbating his menacing and harassing behavior. Mr. L could not afford counseling, so 
the company offered to pay for it to assist him in becoming well. Social services and employment 
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counseling were also offered. Mr. L was receptive to the interview and assistance strategy, and as a 
result his threatening and harassing behavior ceased once he began to feel better. 


> Administrative actions: These actions can include probation, suspension, expulsion, or other 
restrictions. Strict adherence to policies which prohibit bad behavior and provide for discipline are often 
a must, as habitual violation of limits and boundaries without enforcement may encourage additional 
bad behavior. Care should be taken to avoid creating another grievance if possible. In cases where 
expulsion or other removal from the environment is implemented, that entity should contact the 
appropriate authorities or a counterpart, such as law enforcement or a new school, and share 
information needed to continue effective threat management. An interview should be conducted, if 
feasible, to identify the person’s plans and reaction to the administrative action. Regardless of the 
action chosen, preserving dignity should be a top priority in all interactions. Alternatives such as 
voluntary leave, perhaps due to medical or mental health concerns, with defined standards and 
conditions for return, may also be considered. 


Student M was a good student who held several leadership roles in high school. However, he 
held a grudge for being ridiculed by other students and believed he was being persecuted by his 
teachers because of his sexual orientation and his racial origin. Student M authored an assigned essay 
about a character, who endured difficulties in school and felt betrayed by others. The paper outlined a 
scenario wherein this character brought a gun to school and shot multiple people, who were presumed 
to be actual students and faculty, before committing suicide. In response, the school told Student M he 
could graduate early and avoid expulsion by completing certain requirements, which included no access 
to firearms, no contact with school staff, and a mental health evaluation. He adhered to all conditions 
and was making college and career plans. Independently, local law enforcement filed misdemeanor 
criminal charges for disorderly conduct in relation to the essay. The BAU opined Student M posed a low 
level of concern for violence and that criminal charges may compromise his future and fuel his 
grievance. The district attorney's office offered Student M the option of entering a pretrial diversion 
program provided he sign another contract whereby he agreed to refrain from conduct that would 
result in his arrest for three years. These contracts established boundaries and served as reminders to 
Student M that he would be held accountable for any future bad behavior. He went on to college and 
successfully completed his education without incident. 


In another example, Mr. N published a novel that very closely tracked real events in his life and 
which described a character who engaged in a workplace attack after being fired from his job. His 
narrative had a fantasy rehearsal quality to it, and its characters were easily identified as real-life co- 
workers. The graphic detail and carefully planned attack described in Mr. N’s writings raised concerns 
that he could be considering violence himself. In the actual workplace, he appeared to “get away with” 
a considerable amount of bad behavior. He had been formally warned on two occasions for openly 
disregarding policy and supervisory instructions, and behaving disrespectfully. The BAU recommended 
that his employer discipline him for writing the novel as violating company policy prohibiting 
threatening or menacing behavior. Disciplining him set boundaries and limits on his behavior, and 
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communicated to him that he could not act in any manner he wished. The BAU recommended he be 
asked to sign a behavioral contract that clearly outlined expectations and consequences for bad 
behavior, which would be strictly enforced. Once Mr. N realized his behavior had to change or he risked 
losing his job, he stopped threatening and intimidating other employees. Continuing observation was, 
however, recommended for a period of time following stabilization of the situation. 


> Civil actions: Options vary according to jurisdiction but include trespass warnings, restraining 
orders, and orders of protection, all sought under the authority of the court. Specificity in these orders 
is very important and should include clear boundaries, prohibitions, and consequences or legal 
implications for violations. Violations of a judge’s order should be strictly enforced in a professional 
manner that preserves the dignity of the person of concern but reinforces the importance of abiding by 
boundaries. Threat management teams should recognize that civil orders may have the potential to 
inflame the person further and should thus carefully consider the implications of such action. The 
decision to pursue a civil order rests solely with the person or organization seeking the order. 


> Criminal enforcement: These actions include arrest and prosecution under appropriate local, 
state, and/or federal laws, to include revocations of probation. Threat management teams should 
recognize that these options may have the potential to inflame the person further and should thus 
carefully consider the implications of such action. If criminal enforcement is chosen, further 
coordination and appropriate information sharing—with victims, mental health professionals, 
prosecutors and defense counsel, the court, pretrial services, the incarceration facility, probation and 
parole services—is essential. Some crimes appear simple at first glance, such as trespass, but may in 
reality be indicators of more complex and concerning behavior. There may be a difference between the 
crime committed and the violation charged, and it is imperative to understand the context of each 
violation before deciding on everything from charging decisions through post-conviction considerations. 
Each step is an opportunity to apply threat management strategies. 


> Setting specific boundaries and limits: Threatening behavior is behavior that would cause a 
person of ordinary sensibilities to fear injury or harm. It is not limited to communication; physical 
actions intended to intimidate others are threatening as well. When ignored, these behaviors can 
escalate to more serious problems. Someone who engages in harassment, intimidation, bullying, or 
making threats may be doing so with intention, and the behavior may be repeated as long as it is [a] 
effective in supplying the person with something he wants, or [b] not stopped by an authority with the 
power to do so. A commonly used technique which assists with both assessment and management is 
setting specific boundaries and limits tailored to an individual situation and any particular threatening 
behaviors. As an assessment/reassessment technique, there is value in watching to see what the person 
of concern’s reaction is to a limit that has been set. As a management technique, setting limits on 
behavior often works well, and the person of concern learns from that moment onward that bad 
behavior has consequences and will not be tolerated. 
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> 100% Enforcement: Total enforcement of all rules, limits, boundaries, laws, and orders can be 
effective in many cases to get a person of concern “in check” when he has established a pattern of bad 
behavior without consequence or challenge. As with any management strategy, 100% enforcement 
should only be implemented after a thorough assessment has been conducted. First, it may not be a 
wise approach for some volatile, psychotic, or paranoid persons of concern. Second, as noted later in 
this chapter, “zero tolerance” policies as blanket rules are not always suitable. 


Mr. O had a pattern of harassing, stalking, and threatening a police sergeant and others, related 
to his perception that the sergeant had failed to investigate a case to his satisfaction. He also believed 
that various persons in his community were conspiring against him. Mr. O had been hospitalized 
numerous times, had a known history of methamphetamine use, and wrote frequent letters, blogs, and 
made videos about his complaints and conspiracy theories. He had an outstanding warrant for a 
stalking-related offense. Among the threat management strategies recommended were consistent and 
immediate enforcement related to all violations of the law, and arresting him on the outstanding 
warrant as soon as possible. The BAU also recommended that, because he demonstrated a degree of 
paranoia, police be as transparent as possible with him at all times, such as clearly outlining the exact 
procedures they would follow during and after his arrest. 


> Mental health commitments: Hospitalization of the person of concern is sometimes necessary 
to protect his safety and that of others. Involuntary commitments can be quite difficult to secure. Each 
state has its own specifically articulated standard for commitment, but generally a showing must be 
made that the person of concern shows signs of mental illness and poses an imminent risk of harm to 
himself or others, or is unable to care for himself.2 Decision makers may be well-advised to avoid the 
temptation to accept a mentally ill person of concern’s agreement to voluntary commitment when he 
already meets the standard for involuntary commitment. If the person voluntarily commits himself, 
there may be nothing to stop him from checking himself out of hospitalization whenever he wants to 
leave. Further, a record of voluntary commitment may not have the same impact on the person’s ability 
to legally possess firearms and ammunition. 


It is essential for stakeholders to provide collateral information to the mental health provider. A 
person of concern could exploit the therapeutic alliance mindset by manipulating, malingering, or 
withholding relevant information. Telling the truth about violent intentions does not align with the 
goals of a person who does, indeed, truly intend harm. He may fear that truth-telling may cause him to 
be held longer, which is counterproductive to his goal. Evaluators should not base their decisions solely 
on the information provided to them by the person of concern, (e.g. “Of course | didn’t mean that — | 
was just upset.”). 


Law enforcement officers are reminded that HIPAA and other privacy laws do not prohibit them 


from providing information to a mental health professional; the mental health professional may not be 


4 One resource for identifying inpatient and outpatient standards for assisted psychiatric treatment, court-ordered 
assisted treatment, and emergency hospitalization by state may be found at www.treatmentadvocacycenter.org. 
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able to confirm patient status but may still legally accept this information. It is absolutely critical to 
ensure that mental health practitioners responsible for conducting intake or other evaluations have 
100% of the case information available to them. 


Student P was a criminal justice major with a high GPA. A high-risk admission, he had a long 
criminal history of alcohol and drug offenses, and a history of violence. His grievance was that he 
believed the faculty and students were sharing information about his criminal history. Student P sent 
threatening emails which caused a referral to the campus threat assessment team. When he sent a 
message that he was planning to commit suicide, he was involuntarily committed to the hospital for a 
mental evaluation. A forensic psychiatrist conducted a thorough evaluation and concluded he suffered 
from a delusional disorder and that his conduct would not change without treatment with antipsychotic 
medications. However, Student P had a long history of noncompliance with treatment and a history of 
self-medicating with alcohol and illegal drugs. Therefore, the treating psychiatrist recommended that he 
be forcibly medicated with injectable antipsychotic medications. In a similar case involving an 
“outpatient commitment,” a person of concern was allowed the option of taking injectable antipsychotic 
medication because he would not comply with pills; he had to go to a local clinic for his injection once a 
month. While he did not legally have to submit to injections, failure to appear on the set dates would 
trigger immediate reassessment by the local threat management team and the potential for inpatient 
commitment. 


> Substance abuse treatment: Options include inpatient hospitalization or outpatient drug 
treatment programs, random urine toxicology screens, court-ordered drug screens, and self-help 
programs such as Alcoholics Anonymous. 


Mr. Q posted numerous threats directed to law enforcement and a minority group on social 
media. He had anti-government views, was paranoid, and had a history of alcohol and substance abuse. 
He was involuntarily committed for psychiatric evaluation and treatment as a teenager after assaulting 
his mother. He had attempted suicide at least once. He was also tied to illegal drug distribution, and 
was a known user of methamphetamine. A mental health professional consulted on the case and 
opined that Mr. Q’s drug use was linked to his paranoia and threatening behaviors. Additionally, it 
dramatically reduced his quality of life and created additional stressors for him. Mr. Q was arrested for 
felony trespass in another jurisdiction during the time a threat assessment was being conducted. The 
BAU recommended coordination between jurisdictions and mandatory substance abuse treatment as 
part of any plea agreement or sentence, as a potentially highly effective threat management technique. 


> Other services: Other needed services may be offered to the person of concern, depending 
upon his needs and circumstances. These may include counseling or outpatient mental health care, 
stress and anger management classes, alternatives to violence counseling, residential assistance, 
financial counseling, work training, and any other available options. Aside from the obvious 
humanitarian concerns, it is in the best interest of an organization or community that persons of 
concern have access to services and assistance that reduce the likelihood of violence.”” 
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Student R was a middle school student who wrote concerning journal entries and drew pictures 
of violent characters related to depression, anger, and death. His family reported suicidal ideations and 
past treatment for depression. With a history of being ridiculed and bullied, he drafted a list identifying 
multiple students he wanted to kill and whom he believed deserved to die. According to Student R, his 
“other personality” would do the killing. The school initially suspended him and offered him outside 
counseling options, but ultimately expelled him for two years. The only way he could return earlier than 
two years would be to receive a psychiatric evaluation and opinion that he did not pose a threat to the 
school. The student’s home life was unstable and neglectful and his family's relationships were strained 
and conflicted, providing an environment with minimal nurturing and ever-increasing isolation. He 
wanted to see his friends and return to school. However, he did not meet the terms set for re- 
admittance due to lack of both financial resources for an evaluation and any effort by his family to 
obtain services. To further complicate matters, the family moved to a different school district, whose 
staff was not very helpful to the family in navigating the system. The BAU felt the best available 
management plan for the student would be to place him in a structured learning environment where he 
could receive needed services, attention and socialization, and be exposed to healthy, positive 
influences. Additionally, the BAU recommended that his family be referred to a county behavioral 
health services program which could extend assistance to the family regarding case management, 
parental resources, and community organizations. 


> “Outside the box” thinking: Management techniques are only limited by the team’s creativity 
and the law—any technique drawn from a creative or new perspective must comply with local, state, 
and federal laws. “Thinking outside the box,” or innovative thinking, can provide the opportunity to 
resolve grievances or disrupt planning in ways not previously experienced by the person or not 
considered by the team. 


For example, Mr. S wrote a “manifesto” type of document containing very concerning language. 
Additional information subsequently led to the conclusion that he posed a high level of concern for 
imminent, targeted violence. Interviews conducted with his roommates, as well as evidence found at his 
residence, caused stakeholders to seek his immediate confinement. Although no charges were 
identified at that moment, law enforcement was able to detain him on a mental health hold. However, 
within 24 hours, the hospital planned to release him based upon his denial of violent intent, in spite of 
evidence strongly suggesting he should not be released; the treating psychiatrist had not reviewed all of 
the information provided by law enforcement. Mr. S denied any harmful intent and did not wish to 
comply with treatment or with boundaries on his behavior. In anticipation of his release, the now 
substantial multi-agency, multi-disciplinary threat management team scrambled to find additional 
“outside the box” solutions. Civilian prosecution was not possible at that time. One unique solution was 
to place Mr. S, who was a military reservist, on active duty orders as a means of enforcing limits and 
boundaries on his behavior. The team worked closely with his command to implement threat 
management planning while he was under mandatory compliance with military orders. 
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In another example, Mr. T was threatening Company 1. No charges could be filed because there 
was no law which criminalized threatening communications directed to a company as opposed to an 
individual. Threat managers recommended filing criminal charges as an effective means of managing 
Mr. T’s menacing and threatening behavior. The local police chief recognized a gap in the ability to 
protect his community and successfully lobbied the state legislature to change the law to criminalize 
such threats to an institution or company. 


Situation 
> Address the grievance: Addressing a person’s grievance is often overlooked as a management 


technique for various reasons, including stakeholders’ notions of fairness, perceived financial or legal 
constraints, fatigue, or pride. However, addressing the grievance can alter a person of concern’s 
trajectory toward violence. Many options are available to address the person of concern’s grievance. 
Waiver of fees or debt, deadline extensions, distance learning, severance packages, alternatives to 
standard business practice, or other options may allow the person to achieve a goal, allow him to feel 
heard, or preserve his dignity. In the workplace, extension of health insurance, retirement, or other 
benefits, even when not legally required, may be helpful. In the school setting, allowing a student of 
concern to transfer to a different class, change fields of study, or to complete his studies online, could 
reduce tension. Addressing a grievance may not always be easy in the case of persons resistant to 
compromise, or palatable to stakeholders in the case of toxic or destructive individuals. However, 
finding a way to do so may reduce the potential for violence. 


> Dual phase terminations or expulsions: When termination, expulsion, or other removal must 
happen, the manner in which it is done should consider the preservation of dignity and respect for the 
person of concern. A dual phase strategy has been used successfully to accomplish a separation with an 
emphasis on both safety and dignity. The first part of a dual phase strategy is notification of the 
separation, which should be delivered in a minimally intrusive, minimally embarrassing manner. The 
next phase of the process occurs at a secondary location, where a cooling off period is provided, 
caretaking begins, and assistance or services can be offered. This second phase can be implemented by 
someone similar to a well-chosen third party monitor, who will be able to establish rapport and empathy 
with the person of concern. This individual may be a representative of an employee assistance 

program, a respected mentor, a loved one or even law enforcement—anyone positioned to ensure the 
person of concern remains stable and feels he has options for the future. During this time, the person of 
concern can absorb the information provided during notification; this time also allows for observation of 
his reaction. An exit interview can also be conducted, if feasible, by a well-chosen interviewer. At the 
conclusion of this part, a successive follow-up strategy is introduced. It may take the form of scheduled 
or unscheduled periodic check-ins by a suitable third party monitor. 


For example, Student U attended a technical college and was overheard by several students and 
a teacher making statements that he would bring a gun to school and kill people. By the time the case 
was reviewed by the BAU, the school had already decided to expel him, though it was receptive to 
guidance about preserving his dignity and preventing any furtherance of the grievance. A dual-phase 
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expulsion process was suggested, which entailed informing Student U of his expulsion in person as 
opposed to via telephone, email, or mail. The school initially intended to have many members of the 
faculty present, but the BAU expressed concern that this might appear to the student that the school 
was “ganging up” on him. The BAU recommended that a dean meet privately with Student U to inform 
him of the decision and all appeal options in a clear and concise manner. After notification, a crisis 
counselor who had previously worked with Student U met with him to help him process the information. 
This also allowed for an observation period in which any signs that he may be contemplating an act of 
violence or self-harm could be seen. Following the dual-phase expulsion, the crisis counselor, with 
Student U’s permission, checked in on him later that night, and then for a logical period of time 
afterward in order to assist in monitoring for concerning behavior. 


Setting 
> Increased vigilance/target hardening: When a concern for violence rises above “low,” this 


option may be advisable. It is particularly important when a team assesses that management options 
directly related to the person of concern are very limited. Examples of increased vigilance may include 
increased awareness by personnel in and around the environment in question, training on and 
adherence to security procedures, identification verifications, information sharing, and law enforcement 
alerts. In addition to physical preparations, potential targets should remain alert to the possibility of 
virtual research via their public and private networks. Target hardening can involve a thorough security 
process review, reduction of access points to the facility, more visible security, parking lot security and 
escorts, flagging the address in the “911” system, and other measures deemed appropriate. 


> Organizational culture considerations: Organizational culture, or environment, is an important 
factor to consider when planning threat management, and modifications to culture could be 
recommended as part of a larger strategy. The BAU fully recognizes the potential enormity of such a 
task; however, organizational cultures which allow bullying, harassing or menacing behavior, and threats 
do exist. This type of environment is not conducive to a sense of shared responsibility for safety and 
respect. Healthy organizational cultures which effectively mitigate violence risk via a culture of safety 
and respect often share the following commonalities: 


Everyone is treated with fairness and respect 

The organization communicates effectively 

Leaders set and enforce appropriate boundaries 

Members of the organization are held accountable for their behavior 

The organization fosters a nurturing environment 

Bullying and threatening are not tolerated 

Members of the organization are encouraged to report bad behavior without fear of 
repercussion®° 


oO 0 00 0 0 
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Target 

> Target vulnerability reduction: A target’s vulnerability can often be reduced by target 
hardening; however, other measures could further reduce a target’s exposure to violence 
potential. Examples include but are not limited to: 


Changes to work hours for particular individuals 

Work space relocation 

Social media privacy management 

Varying routes, routines and activities 

Parking lot escorts 

Ceasing communication with the person of concern in some cases 


oO0O0 000 0 


Personal safety planning 


In addition, potential targets should be encouraged to fully cooperate with police and 
organizational investigations and interventions. Sometimes, targets become frightened, angry, and 
impatient with the person of concern’s bad behavior and do not always act with prudence. Also, targets 
may become fatigued from constant vigilance and lose interest in being cautious. A strong support 
system for targets may be necessary to prevent this from occurring; targets may also require 
implementation of management techniques. 


Zero tolerance policies 

The words “zero tolerance” sound reassuring in that they imply an absolute refusal to condone 
bad behavior. However, use of the term “zero tolerance” is not recommended because it can be so 
easily misunderstood, and research has shown that zero tolerance policies have been found to actually 
deter reporting of bad conduct; bystanders may fear their reports could lead to immediate and harsh 
repercussions without due process and possible retaliation against the reporter.*?. When zero tolerance 
means that the same, severe punishment is applied to similar incidents regardless of history and 
circumstances, it is detrimental to good threat management. For instance, when a student makes a 
threat and is automatically expelled, stakeholders immediately lose their optic on the student once he is 
homebound. In addition, this action may exacerbate the situation by isolating the student, confining 
him to a potentially negative home environment, and cutting off services available to the student via the 
school system. A flexible policy, however, permits the school to impose less harsh measures with 
greater latitude for promoting safety. An organization’s ability to address bad behavior should include 
multiple options, focusing on an individualized response. 


Caution against becoming the grievance/last straw 

Organizational environment, administrative actions, and interpersonal communications all have 
the potential to inspire or deter an at-risk individual’s decision to engage in planned violence. Threat 
managers should be mindful at all times about inadvertently creating an additional grievance or 
becoming a person of concern’s “last straw.”®? A key consideration is to avoid furnishing the 
psychologically brittle person of concern with the spark that may create, sustain, or fuel a grievance. His 


65 


perception of the world typically becomes his reality, and if he feels wronged he may look to project 
blame onto other individuals or institutions regardless of the true reality of the situation. 


For example, one case involved a student of concern who was suspended for menacing 
behaviors. He planned to return to school at the end of his suspension and did not want his past 
problems at school to be a focus of attention. School administrators felt a need to search his bag upon 
entry onto school grounds, which they were planning to do in public. Inasmuch as it was important to 
the student to remain low-profile, this tactic could have created or inflamed a grievance and led to 
unnecessary, additional stress. A better approach emphasizing both safety and discretion was 
ultimately used, in which a school resource officer conducted a bag search off-premises and then 
observed the student proceed directly to school. 


Prior to implementing visible management techniques, threat managers should consider how 
their decisions, actions, and delivery may impact a person of concern’s life, work, relationships and 
sense of well-being. Threat managers should be mindful of potentially implementing an action that, 
itself, is a precipitating event which either propels him toward violence or removes the last buffers 
deterring him. Sometimes people have to be fired or expelled, but those moments do not necessarily 
have to become the last straw for a person of concern. A person of concern may understand he 
deserves to be fired and accept it; his last straw event may come when he is fired by email rather than 
being given the respect of being fired in-person. 


Mr. V worked as an armed security guard for a government contractor. Negative behaviors and 
conflict with his supervisor were raising concerns about him. During working hours, he made references 
to his personal life, indicating that he was having financial issues, going through the beginnings of a 
divorce, and loved to get drunk on the weekends. Based on poor performance at work, his supervisor 
sent him an email informing him that he was suspended, but did not meet with him in person to discuss 
the situation. The company was then faced with a choice of having to go out and retrieve Mr. V’s duty 
weapon or ask him to return to the work site to turn it in. This was not an optimal way to process a 
termination, and the situation created an unnecessary safety risk. It also risked creating an additional 
grievance by denying him the respect and dignity of an in-person meeting. 


Thinking about potential “last straws” helps stakeholders and threat managers try to see the 
situation from the person of concern’s perspective and aspire to preserve his dignity.®* For some 
offenders, perceived loss of dignity was the last straw that propelled them toward violent revenge. 
Using a sensitive, caretaking approach may reduce the possibility of creating or enhancing a grievance in 
the eyes of a person of concern. 


Mental health is not “the” answer—threat management is the key 

The mental health system is no longer able to be the primary response mechanism in dealing 
with a mentally ill person of concern. It is overrun and lacks the necessary beds to effectively treat all 
actively psychotic, suicidal, and homicidal individuals. This psychiatric hospital bed crisis is aptly 
demonstrated by the tragic case of Mr. W. Mr. W was evaluated under an emergency custody order on 
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a “danger to self or others” finding. Ultimately, he was released to the care of his father because no 
psychiatric bed was available. At that time, state law provided he could be held in emergency custody 
for a maximum of six hours while providers searched for a bed. When one was not found, he had to be 
released. Less than 24 hours later, he stabbed his father multiple times and then committed suicide by 
shooting himself with a rifle. This incident was the catalyst for changing the commitment law in that 
state. 


The mental health system is simply not in a position to be responsible for long-term threat 
management. Beds are limited and will continue to be scarce. Mental health professionals are 
overwhelmed, often having time only to conduct cursory checks for suicidal and homicidal ideation and 
intent. Providing treatment to improve psychological well-being is their primary function, rather than 
organizing a long term management plan in place of key stakeholders (e.g. police, schools, or 
employers). Limits on information sharing make for a cumbersome process to openly discuss symptoms 
and treatment with others. It would be convenient if an already-in-place, well-established apparatus 
was positioned to take on this role, but the mental health care system is not that apparatus. 


“Tarasoff” Duty 


Threat assessment team members should be aware of the Tarasoff duties to warn and protect 
(See Appendix D) in their respective jurisdictions, as this knowledge can become a tool to 
persuade mental health providers to offer critical feedback during high-risk cases when the 
person of concern is in treatment. When faced with a situation that may trigger a duty to 
protect, providers are encouraged to discuss the case with colleagues. These situations are 
often nuanced and problematic to resolve, and present difficult questions such as whether a 
client has a violent fantasy versus a plan to harm another person. Mental health professionals 
should consider directly questioning the person of concern regarding his violent behavior, 
thoughts, and feelings. When deciding whether to breach confidentiality in order to protect 
others, they should not rely solely upon the person of concern’s assertions. (See discussion of 
the distinction of making a threat versus posing a threat, pages 15-16.) Rather, providers are 
encouraged to consider such factors as the person’s past history of violent and dangerous acts, 


personality characteristics, cognitive style and functioning, social history, history of criminal acts, 


current perceived stress, the nature of the social environment, means to accomplish violence, 
access to a victim, substance abuse, presence of anger, diagnosis, current level of functioning, 
and prior responses to treatment. It is equally important for the treating professionals to 
consider the risk presented by precipitating events such as rejection or some type of loss, or 
other warning behaviors. 


Implement and reassess 

Threat management is a dynamic process and strategies will often require adjustments to 
enhance success. Once a strategy is implemented, this begins a period of reassessment, during which 
the management plan’s effectiveness is evaluated and changes can be made. The threat assessment 
and threat management relationship is one of continuous reassessment and modification. If one 
management strategy does not create the results a team is looking for, the next steps are to reassess, 
modify the plan, and try again. (See page 78) 


Thoughtful and reasoned management strategies developed with an understanding of threat 
assessment and management principles usually work well and effectively mitigate violence concern; 
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they will rarely backfire or have no effect, though every team should be prepared for these possibilities. 


Third party monitors can be very helpful in communicating back to the team or stakeholders about any 
reactions from the person of concern. This is particularly true when a plan is implemented based upon 
a preliminary assessment when there are significant information gaps present in the case. In many 

cases, the person’s reaction to management techniques may require reassessment and a new strategy. 


Long-term solutions are frequently required to successfully manage higher concern cases. 
Short-term techniques will often suffice to resolve lower concern matters. As time progresses, “low” 


persons of concern exhibiting recurring behaviors may require additional behavioral management steps. 


The reassessment phase will assist threat managers in identifying points of escalation. Assessors must 
always remember that a threat management strategy may not be as effective as initially planned and, if 
left on autopilot without follow up or adjustment, the person of concern and situation could 
deteriorate. 


Family 

In furtherance of efforts to manage a person of concern away from a potentially violent 
outcome, family members are often a primary point of contact with a threat management team’s 
representative to both understand and manage the person. If the family unit appears to be loving, 
supportive, and an overall positive force, it should be considered a beneficial threat management 
component. Families who support interventions and enforce limits are helpful to the cause. Family 
members can act as third party intermediaries between the person of concern and a team trying to 
manage him away from violence. They should not participate in threat assessment and management 
strategy meetings as it would be unfair and inappropriate to subject them to a conflict of interest. 
However, when it is deemed appropriate and it does not add further risk, teams may wish to provide 
detailed information to designated family members to help them understand the true concern and 
nature of the threat posed by their loved one. The team should carefully consider whether its 
relationship with a selected family member, or any third party monitor, should be made known. 


Conversely, if the family unit seems unsupportive, dangerous, or a negative influence on the 
person of concern, a team should carefully weigh whether or not the risk of attempting a familial third 
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party strategy is worth the possibly low odds of reward. For example, Student X disclosed to his parents 
a desire to harm others, specifically students at his high school. His parents brought him to a mental 
hospital where he was assessed and treated for a period of weeks. The mental health evaluators 
developed a safety plan for him upon his return home which included the removal of all weapons. Both 
local law enforcement and the school were made aware of his intention to harm others. Student X was 
allowed to return to school after being cleared by mental health personnel. However, he was arrested a 
week later, after he made plans and took steps in furtherance of committing violence at the school. His 
parents, who were initially upstanders, felt that law enforcement was now picking on their son merely 
because of the previous notification. Upon learning that law enforcement planned to conduct 
interviews of family members regarding Student X’s plans, his parents assisted Student X in deleting text 
messages and social media evidence of his planning. Further, his parents withheld information about 
weapons present in the house. As a result, charges against the parents were contemplated. 


Questions to ask when deciding whether to use a family member as part of management might 


include: 

> Can the team accomplish the same management objectives through another third party or 
another strategy? 

> Must the strategy also include education, therapy, or management for the family member(s)? 

> Does the family promote isolation, ignore warning behaviors, and/or endorse or indulge 


grievance formation and violent ideation? 

> Does the family have a history of violence, serious mental illness, discouraging mental health 
treatment, or allowing substance abuse to occur? 

> Do motivations held by family members affect their perceptions of the gravity of the situation or 
the necessity of management? 


In addition to having a potentially detrimental effect on good management, an unhealthy family 
dynamic can have other negative results, including the person of concern turning his direction of 
interest and grievance towards a loved one or caretaker. In some cases, family can actually accelerate 
the person of concern toward violence, for example, by supplying weapons, ammunition, or 
opportunities for shooting practice. 


If a strategy using a family member is employed, consideration must be given to long-term goals 
and the possibility of fatigue. The energy expended by the family or a selected family member could be 
time-consuming and exhaustive. A family’s perception of the person of concern can evolve or degrade 
over time; they can develop animosity, sympathy, or take a defensive stance regarding the person. They 
may justify and downplay the person’s behaviors. Any one of these responses may supply the person of 
concern with the freedom and detachment needed to engage in threatening or violent behavior. 
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Threat management is like good parenting 

Good threat management should reflect the same positive characteristics of good parenting. 
Teams should act with care and thoughtfulness; set limitations and boundaries for the person of 
concern; and apply appropriate consequences intended to change behavior for the better. A well- 
functioning threat management team: 


> Understands the value of caretaking 

> Plans well and understands when urgency is needed 

> Cooperates and shares information well amongst members 

> Sets rules and boundaries 

> Provides guidance and follow-through for persons and entities carrying out the management 


plan 
Continually re-evaluates active cases and re-engages when necessary 
Understands that patience may be necessary during the entire process 


VV 


These characteristics are akin to a healthy parenting style. A good parent has the ability to: be a 
caretaker, plan, cooperate, be patient, set rules and boundaries, provide guidance, follow-through, 
ensure consequences for rule-breaking, and continually re-evaluate how things are going to ensure the 
child becomes a successful member of society. The end goals of threat management are to change the 
person of concern’s behavior and pattern of thinking for the better, avoid violence, and stabilize the 
situation permanently. 
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Chapter 5 Threat Management Team: The Set Up 


The previous chapters of this guide provide information about assessing and managing persons 
of concern. Threats of violence are ultimately a community issue, often requiring collaboration across 
many entities within the community. Ideally, the threat management team will establish collaborative 
relationships early on and maintain ongoing interaction and dialogue with key resources over time. 
What follows is a description of threat assessment and management team mechanics. Questions about 
why and how threat management teams work, achieving and maintaining a knowledge base, and getting 
resource commitment and support from organizations are addressed herein. 


Why threat management teams work 

The threat management team model is a viable and effective method for assessing violence 
potential and disrupting planned attacks of targeted violence. No one person is positioned to see every 
single risk factor, warning behavior, or mitigator, nor is one single individual positioned to manage a 
threat. When ateam member receives a new case for review, he may extract an important detail due 
to his particular skill set, whereas other team members may not initially recognize its importance. For 
instance, a mental health professional may recognize signs of mental decompensation, which could 
simply appear as a change in personal hygiene to another member. A team member may ask a question 
during the consultative process that prompts others to think in a different way. This in turn could lead 
to a more accurate assessment and a more creative, and ultimately successful, threat management 
strategy. Symposium participants believe that consensus, derived from individual assessments of team 
members acting in concert, is the most powerful method to assess and mitigate future violence 
concern. Open discussion and professional debates or disagreements are embraced. Diverse 
perspectives can generate new investigative leads and can prompt additional areas for inquiry, thus 
allowing for a more complete, holistic and accurate threat assessment and management. 


Logistics 

A threat assessment and management team is a multidisciplinary body, trained to assess and 
recommend management strategies for persons of concern and threats of violence. The functions of 
these teams are to: 


> Gather all available information related to reports about a person of concern or threats of 
violence 

> Determine, via threat assessment, whether the person of concern poses a safety threat 

> Offer reasoned and thoughtful management recommendations designed to reduce targeted 


violence concern and promote safety for all, including the person of concern 


As communities build threat management teams to address concerns about targeted violence, 
they must consider multiple logistical requirements. This chapter addresses a host of such 
considerations, ranging from the recommended composition of a team to retiring a case. 
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Multidisciplinary 

A multidisciplinary make-up is perhaps the single most important feature of an effective threat 
management team. Highly effective teams facilitate collaboration, coordination, and communication 
across various parts of organizations or communities to address persons of concern and threats of 
targeted violence. They will often need to leverage the perspective, expertise, and insight of various 
disciplines to aid in effectively assessing concerning behaviors and to develop threat management 
strategies.** Threat management teams should be comprised of a core group of representatives from 
relevant disciplines, such as law enforcement, security, mental health, social services, legal, human 
resources or administration, or others relevant to the entity establishing the team. A threat 
management team with a well-rounded composition of diverse members provides a versatile team of 
practitioners with different perspectives, capabilities, and backgrounds to address targeted violence 
concerns. 


Many “person of concern” cases will involve individuals demonstrating warning behaviors and 
exhibiting risk factors, but where no punishable violations or infractions have occurred. Alternatively, 
they may have occurred but a course of action involving punishment may not be wise at a given point in 
time. In such cases, good management may require the expertise of community-based mental health 
services, social services, law enforcement, and other resources to effectively address them. For 
example, a person of concern may have a grievance about utilities because he cannot afford to pay the 
bills; social services may have a unique knowledge of special funding programs which can assist. Having 
a multi- and interdisciplinary team of members from diverse professions in place provides specific 
options and flexibility to aid in addressing the situation. This approach facilitates collaboration across 
various parts of a community and/or organizations that is fundamental to effectively assessing and 
managing a person of concern.® 


Co-deployment model 

When setting up a process for making contact with high risk persons of concern, strong 
consideration should be given to a co-deployment model which pairs more than one discipline for both 
proactive and responsive calls. For example, the Los Angeles Police Department’s Threat Management 
Unit often teams up with the police department’s Mental Evaluation Unit, which co-deploys mental 
health clinicians with a law enforcement officer to calls. By arming the team with human resources 
needed to diffuse potentially explosive situations, officers are better equipped to deal with persons in 
the midst of a mental health crisis and clinicians are in the presence of sworn officers when dealing with 
the potentially violent. This model can be adapted to other situations. A local threat assessment team 
deciding that community services should be offered to a person of concern could choose to deploy a 
police officer along with the social worker to visit the person’s home. A school resource officer 
conducting an interview of a student who has made threats may be joined by the school psychologist for 
the encounter. Bringing together the disciplines of law enforcement and mental health can provide an 
enhanced ability to assess and begin managing a person of concern. 


For example, Company 2 terminated Mr. Y after he stalked several female coworkers. Following 
his termination, he was observed several times following employees and confronting them when they 
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were leaving the office. He was evaluated and diagnosed with a mental illness. A mental health court 
determined that he was a danger to himself and others, and determined that he could be released with 
the stipulation that his psychotropic medication be administered via injection at home. However, Mr. 
Y’s behavior was so concerning that the medical staff assigned to administer his injections was too afraid 
to go to his home. As a result, he began to decompensate and act out in an alarming way. A potential 
solution could have been to co-deploy police officers with medical service personnel to ensure their 
safety. 


Team establishment 

Convincing stakeholders that “something” needs to be done with persons of concern is often 
not a challenge. But who should be doing it? Some communities and organizations are big enough that 
setting up a threat management team is easily conceived and resources are readily available to get it 
done. This is not true for every community or entity. In rural or other areas without abundant 
resources to leverage, one suggestion is to partner with the local emergency management apparatus to 
create a community-wide team. Although emergency management is not established and educated to 
conduct violence threat assessment, the discipline does have experience with mobilizing 
multidisciplinary resources in a cooperative manner to achieve long- and short-term objectives. Local 
emergency managers may be amenable to leveraging their interagency and community resources to 
assist law enforcement and others’ efforts to stand up a team. Lack of immediate resources or 
infrastructure is a common obstacle, and yet these are overcome by communities every day. Additional 
resources may be available at the county, state, or federal level, such as established threat assessment 
teams including those in other jurisdictions, professional associations, publications such as this guide, or 
grant programs. 


Core and ad hoc membership 

The core members of a team will triage, assess, and manage all cases that meet the team’s 
threshold for case initiation. They attend all meetings of the threat management team and should 
conduct outreach to educate their community on the value of the threat assessment and management 
process. As stated previously, threat management teams should be comprised of a core group of 
representatives from relevant disciplines, such as law enforcement, security, mental health, social 
services, legal, human resources or administration, or others relevant to the entity establishing the 
team. 


Ad hoc members are those who will join a team for specific cases in which their fields of 
expertise are needed rather than all of them. These supplemental members should be identified and 
called upon as necessary based upon their subject matter expertise, placement within the environment 
or management structure around the person of concern, or special skills that may be required in specific 
cases. For example, a case may require a member with sufficient cyber skills to assist on a case involving 
anonymized online communications. 


Some people, depending on their status and connection to the person of concern, are not 
appropriate for membership on the threat management team. These include, but are not necessarily 
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limited to, a treating mental health care provider with whom a privileged relationship has ever been 
established; an immediate supervisor; a student of concern’s teacher; a family member, friend, or 
intimate partner; or clergy with whom the person of concern has a pastoral relationship. For them, 
participation in threat assessment and management strategy meetings would be unfair, objectivity 
might be lost, and it would subject them to a conflict of interest. 


A recommended core composition of a threat management team can include those identified 
below. Composition may be different depending on the organization forming the team. 


> Law enforcement: This person brings law enforcement agency representation to the table, 
organizational structure, record keeping abilities, and can speak to investigative recommendations and 
enforcement options. This representative has access to criminal history and other law enforcement 
information (although sharing of sensitive law enforcement information is often limited by statute). This 
member may be best positioned to lead the team, depending on the circumstances. 


> Employee assistance/social services: These representatives will be well-positioned to provide 
information about services and assistance available through an employer or a community for the person 


of concern. He also has knowledge of the administrative burdens involved with the engagement of 
many management techniques, unique programs and resources available, and how to assist people in 
crisis. 


> Facility/campus/organizational security: A security department representative is able to provide 


insight into safety and security measures in place at the setting in question and in relation to some 
potential targets or persons of concern. This representative has the power to make security related 
decisions or at least endorse management strategy recommendations to senior security leadership. 


> Human Resources: A representative from an organization’s human resources department is 
needed in cases which develop within the employment context. This representative can speak to 
employer policy, procedure, and organizational culture. This member has the power to act on 
management strategy recommendations or at least endorse them to executive leadership. In military 
contexts this might translate to an officer in the person of concern’s command structure. 


> Legal: An attorney can help a threat management team navigate the many legal issues which 
can and will arise during the course of any given case. Privacy laws, in particular, can be challenging to 
correctly understand and navigate. Appropriate choices for legal counsel could include, but are not 
necessarily limited to, school district attorneys, corporate attorneys, or jurisdictional prosecutors. It is 
important for the attorney to be able to identify potential legal issues and corresponding remedies. 
More than one lawyer could be needed for any given case, depending upon the team’s needs and 
experience level. 
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> Mental health: This can include a clinical or forensic psychologist or psychiatrist with experience 
in treating and assessing the seriously and persistently mentally ill and/or violent individuals. Any 
mental health professional with significant clinical or forensic experience will be helpful. If such specialty 
access is limited in the geographical area, a psychiatrist, clinical psychologist, clinical social worker, or 
other mental health professional would also be beneficial. This member should not have any past or 
present treatment relationship with the person of concern being assessed by the team, but rather be an 
objective third party who can assist the team in understanding mental health symptoms and associated 
behaviors, diagnoses, mental health resources and treatment, and threat management strategies. 


> School administration: A representative of the school district or particular school is needed in 
cases which develop within an academic context. This representative can speak to school policy and 
procedure, the cultural climate of the school, and can assist team members in understanding the 
mechanics of the person of concern’s daily life at the school. This member has the power to act on 
management strategy recommendations or at least endorse them to the administration. 


New referrals 

A case leader should be identified in order to have a single point of contact to promote 
information flow and case management. This individual will ensure all available relevant information for 
the case is collected, organized, and disseminated to other members of the team. That leader should 
coordinate additional resources and liaise with entities which can assist with the threat assessment and 
management. 


All new case referrals to the threat management team should be triaged as soon as possible in 
order to assess an initial level of concern for potential violence. Naturally, cases preliminarily assessed 
as generating a high level of concern should be prioritized and managed appropriately. Those cases of 
lower concern may not require a full-blown assessment or meet the threshold for initiating a case. The 
triage process should also involve identification of needed resources and ad hoc team members, as well 
as initiate information gathering. 


Process 

First, consider creating a mission statement or objectives for the program. This will serve to 
guide all policies and actions in a coherent fashion. As an example, one team devoted entirely to 
students of concern in a mid-sized US metropolitan area has identified three objectives:*° 


> Identify and assess threats of potentially harmful or lethal behavior and determine the level of 
concern and action required 

> Organize resources and strategies to manage situations involving students that pose threats to 
other students, staff, and the community 

> Maintain a sense of psychological safety among students, teachers, and parents, thus fostering a 
learning environment that allows for teaching and learning that is free of the distraction caused 
by fear 
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Second, establish how the team will operate. Will it, itself, investigate and manage cases or will 
it perform an advisory role for those agencies on the front line? The method that works best for a team 
may depend on many factors including resources, legal authorities, strategic priorities, and the 
preferences of the agencies involved. In smaller localities, it may be necessary for threat management 
team members to also be those working to resolve the matter. In more populous regions with many 
agencies, it is more likely the team could function in an advisory capacity and the agency which presents 
the case to the team will retain all responsibility for managing it. 


In addition, each team must identify to what extent it is capable of assessing a case. At 
minimum, a team should be able to effectively triage a case in order to determine if the matter is of low 
concern or if a full behavioral threat assessment is needed. If amore thorough assessment is required, 
does the team have the expertise and experience to conduct it or should the case be referred to an 
outside resource? This determination will depend upon the level of training and experience a team is 
able to acquire and maintain. This guide should be helpful to teams, both in assessing cases and in 
assessing its own capabilities. 


Third, what will initiate a new case? The answer will depend upon the needs in a particular 
jurisdiction or organization. Predicating events may include but are not necessarily limited to: 


> A threat or inappropriate communication indicative of violence concern 
> A report of concerning or threatening behavior 

> Issuance of a protective order 

> Recognition of warning behaviors 


Next, a threat management team must set up its intake process and advertise that process to 
the community or organization it will serve, in accordance with any applicable policy. One or more 
individuals should be identified as intake coordinators to whom the information should be reported. 
More than one intake coordinator is recommended to ensure availability of options for witnesses who 
have information to convey. 


A meeting schedule should be devised which accommodates the operational tempo of the team 
and the case load. One meeting a month may be too often for some teams and not nearly enough for 
others. Regardless of what schedule is set, a protocol should be established for initial team review of 
newly received cases, so that each matter receives attention as soon as it comes in. This helps to ensure 
that no case will fall “through the cracks” and be forgotten. 


Once a case is opened, the core members of the team should determine which, if any, ad hoc 
members are needed in order to complete a thorough threat assessment and to effectively manage the 
case. Once the team is identified for a particular case, information gathering should begin to unfold as 
appropriate for the circumstances. As information is acquired on any given case, the team may realize 
emergent need for action has evolved (see pages 23-24 “Triage versus 360° Assessment”). The team 
should have the flexibility to act, or recommend action, as needed prior to completing information 
gathering or conducting a full assessment if immediate safety concerns arise. Some cases may require 
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an emergent response more than once. Therefore, the team should have protocols in place for 
unscheduled meetings, even if only by telephone or video conference. 


Similarly, protocols should be established for how a team shares case information, how a team 
will meet to conduct an assessment, and how its recommendations will be communicated to 
stakeholders. Open sharing of information among team members is quite important for this process to 
be effective. As referenced above (Information gathering, pages 43-44) the silo or stovepipe effect is a 
lack of communication and information sharing between individuals, components, and executive offices 
within a single organization, and can be problematic. This concept also applies to separate and 
independent organizations working to solve a single problem but not fully sharing information. When 
this happens, it can be highly detrimental to good threat assessment and management.®’ For further 
details about protocol and policy recommendations, see “Setting up a policy,” later in this chapter. 


Recordkeeping 

Documentation of each assessment in accordance with individually established organizational 
guidelines is recommended. Records may be maintained by the overall lead agency of the threat 
management team or elsewhere as chosen by the team; housing them at a law enforcement agency 
provides significant protection and allows 24-hour access. All records should be maintained in the same 
place for consistency and the case leader should document the assessment. All written products should 
include caveats potentially encompassing the following points: 


> Any limitations of the assessment, such as acknowledgment of known information gaps 

> Ownership of the document and who is entitled to disseminate it, such as a statement that only 
participating entities (core members) are entitled to a copy and disseminations must have prior 
approval 

> Whether the document is suitable for inclusion in administrative and/or judicial proceedings, 
such as a statement congruent with applicable legal guidelines 

> A statement that recommendations are based upon information known to the team when the 
assessment was completed and a change in circumstances could alter the assessment 


These caveats are intended to protect the team and its processes. The following caveat has 
been used by the BAU: 


The observations, opinions, and suggestions contained herein represent a product of the knowledge 
drawn from personal and collective investigative experience, educational background, specialized 
training, and research conducted by members of the BAU and others, as well as from published 
academic research and known case facts. This analysis is not a substitute for a thorough, well-planned 
investigation, and should not be considered all-inclusive. 


The analysis is based upon information available at the time this report was prepared and assumes that 
the information set forth is valid and complete. Should additional information or case materials become 
available at a later date, certain aspects of this analysis may be subject to modification or change. All 
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threats should be taken seriously, and all reasonable measures to minimize the risk of violence should 
be considered. 


Concerning threat assessments, it is difficult to predict future behavior with certainty. This threat 
assessment serves as an investigative and operational tool which may assist in identifying appropriate 
levels of concern based on research and experience. This assessment is not evidence of violence risk 
or criminal wrongdoing, and is not suitable for use as the basis for testimony. Rather, the assessment 
is conducted and memorialized in order to guide the appropriate allocation of law enforcement 
resources and the prioritization of investigative tasks. 


A threat assessment is only valid for the period of time assessed. Environmental changes, medical 
conditions, neurocognitive impairments, medication (or the lack thereof), alcohol consumption, illegal 
drugs, personal conflicts, psychological disorders, traumatic events, or other factors can affect the 
thought process of an individual. These changes can result in violent acts when none were anticipated 
and complicate the process of attempting to assess the likelihood of violent behavior. 


Individual portions of this assessment are not necessarily severable from the whole, and therefore 
segments of this document should not be referenced or reproduced separate from the remainder 


without explicit approval from the BAU. 


Each time the team meets to discuss a case, there should be documentation of who was present 
during the consultation or meeting, the date of the meeting and consultation, and how the meeting was 
conducted (in person, telephonic, or video teleconference). Assessment documentation should at 
minimum note: 


> Sources of information reviewed 

> A summary of the issues that were the focus of the team’s review, highlighting those issues the 
team considered to be important 

> A level of concern for violence and justification for that conclusion 

> Potential for imminence 

> Recommendations for future action items including management strategies and further 


investigative inquiries 
> Attempts to make appropriate referrals, such as to a prosecuting attorney or to a psychologist 
and/or psychiatrist 


A team which carefully documents meetings and protects those records will have proof that it 
considered certain issues, that it valued the safety and privacy of all parties involved, and that it acted 
reasonably in its efforts in assessing the level of concern and in offering management strategies. 


Confidentiality should be built into the process for both the reporting parties and the person of 
concern. Any case file should be marked and treated as confidential. It should be afforded appropriate 
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security and stored in a manner that limits access to those parties who have a legitimate need for the 
information contained in it. These protections avoid giving the person of concern a new grievance, help 
protect the privacy of individuals involved, and help protect the sources and methods utilized by the 
team. 


Good record keeping over time can afford a team the ability to identify trends and patterns that 
speak to a larger issue. An analysis of these records in addition to published research can provide data 
to support recommendations for organizational change or needed programs in a community. 
Additionally, thorough historical record keeping can be of great value when some cases continually 
resurface. 


Retiring or transferring a case 

The decision to “retire” a case is one which the team should make thoughtfully and with careful 
consideration. Potentially, a case assessed to have a moderate or higher level of concern for violence 
might never be suitable for retirement. It will depend upon the success and estimated permanence of 
management efforts. Most cases, however, will be suitable for retirement at some point. Normally, the 
team will want to follow a uniform process, such as the one depicted below, keeping a case active until 
it no longer presents a concern justifying continued engagement by the team. 


Intake and triage Information Assessment 
Gathering 


Management Management 


Reassessment 


If a case is initially assessed to present a low or nonexistent concern for violence based upon 
analysis of enhancers and mitigators, then immediate retirement may be appropriate without the need 
for much, if any, management. If a case is initially assessed as presenting a moderate or higher level of 
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concern, and is then successfully managed to the point where concern drops to low or nonexistent, then 
it can be retired from active evaluation. The BAU recommends a “holding” period of at least 18 months, 
to allow for observation before retirement. During this period, the person of concern should remain 
stable at “low” concern for the entire 18 months or more, before a decision to retire a case can be made 
with any confidence. 


If a person of concern moves out of the immediate area, it may become necessary to transfer 
the case to the logical threat management team or stakeholders in the new locale. Or, if additional 
targets or behaviors are discovered outside the immediate area, it may become necessary to collaborate 
with another team. For example, Mr. Z was identified by Law Enforcement Agency 1 due to 
inappropriate or concerning behaviors directed towards a government official; he was complaining about 
a court case and seeking assistance. Mr. Z’s behaviors were assessed and managed over time, 
preventing escalation and possibly preventing violence. Over time, and for a variety of reasons, he 
changed his direction of interest away from the official and toward a judge who ruled against him. The 
case was transferred to Law Enforcement Agency 2, which was responsible for judicial security in that 
jurisdiction, for continued assessment and management. As Mr. Z’s grievance intensified towards the 
judge, Law Enforcement Agency 1 continued to coordinate with Law Enforcement Agency 2. The case 
transfer was accomplished only after a considerable amount of discussion and coordination to make 
certain that both agencies agreed with the transfer and that continued communication would be in 
place in case he refocused on the governmental official. 


Competing assessments 

Teams should avoid conducting or soliciting competing behavioral threat assessments and 
management plans from more than one expert or threat management team. First, if an entity is 
attempting to manage a case and receives conflicting advice from multiple sources, it will likely cause 
confusion and uncertainty. Second, to the extent any conflicts between those assessments exist, it 
could become problematic in the event of subsequent litigation. Virtually all records may be ultimately 
discoverable during litigation, and the existence of differing assessments could present unforeseen and 
unnecessary concerns. 


Becoming and staying informed 

There are many resources for knowledge and training available within the threat assessment 
community, in addition to this guide. Currently several established, not-for-profit associations dedicated 
to the threat assessment discipline are the Association of Threat Assessment Professionals (ATAP), the 
Canadian Association of Threat Assessment Professionals (CATAP), the Association of European Threat 
Assessment Professionals (AETAP) and the Asia Pacific Association of Threat Assessment Professionals 
(APATAP). Threat management teams may wish to turn to these associations for training and resources.° 


© These associations can be found at www.atap.worldwide.org, www.catap.org, www.aetap.eu, and 
www.apatap.org respectively. 
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Just as in medicine or law, it is advisable to ensure those responding to behavioral referrals are 
qualified to do so. Although each discipline representative on a threat management team brings a 
particular expertise and background to the table, threat assessment is a unique discipline grounded in a 
body of knowledge derived from research and experience. Team members should consider and pursue 
achievable ways to acquire and maintain knowledge to have a basic level of proficiency. This 
proficiency should allow team members to appropriately identify, assess, and manage persons of 
concern. This task is complex, nuanced, and often time-sensitive. Asking a person of concern if he is 
going to hurt someone is not a threat assessment. Advising a parent that his child has formed a 
grievance and demonstrated violent ideation is not threat management. Educational credentials in 
fields such as psychiatry, psychology, or law do not necessarily constitute expertise in threat 
assessment. In fact, the specialty of threat assessment is typically not taught during the training and 
education for these three professions. As with any specialty, it is incumbent on the participant to 
acquire adequate training and supervision until competent in this specialized skill. 


One team, one goal 

Like any effective program, threat assessment and management require a clear “top down” 
commitment from within the sponsoring organization or community.®® Executive leadership 
endorsement cannot be passive; leaders must actively and visibly support the threat assessment and 
management process. This should ensure the organization: 


> Designates the process as an organizational priority 
> Adopts and endorses enabling policies 

> Identifies and allocates sufficient resources 

> Appoints appropriate personnel to the team 


For ideal effectiveness, each employee, student, parent, or member must “buy in” to both the 
idea and the process of threat assessment and management. When training is offered, all appropriate 
personnel should participate. If reporting of concerning behavior is mandated, all should be encouraged 
to comply. As discussed above on pages 14-15, a culture of shared responsibility, safety, and respect will 
foster top to bottom support within an organization or community. 


Setting up a policy 

Organizations may need to consider establishing a violence prevention policy. Although specific 
guidance on the content of such a policy is beyond the scope of this guide, some general points may be 
considered for inclusion:°° 


Definition of unacceptable behavior and identification of consequences 
Reporting of threatening behavior and actual violence via multiple avenues 
Promotion of conduct that supports a culture of safety and respect 
Accountability for unacceptable behavior 


VV VV V 


Coordination with other organizational policies” 


The BAU encourages organizations creating policy or violence prevention programs to consult 
with legal counsel, administration, and any other appropriate authorities regarding language and policy 
directives. 
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Conclusion 

This guide results from the tremendous efforts of scholars and practitioners from many different 
disciplines over several decades of research and experience in threat assessment and management. 
Although it is not intended to be all-encompassing, it is hoped that this publication will provide a 
valuable resource for communities and organizations, and for novice and experienced threat managers 
alike. In addition, there are many sources of information which elaborate on the points summarized 
herein. Readers are encouraged to seek out the resources identified in the references section. 


Understanding the nature of targeted violence is a necessary precursor to effective assessment 
and management. It is planned and purposeful, and yet could be conceived and carried out over a short 
period of time depending on the situation and circumstances. A person of concern’s movement along a 
pathway to violence is often observable to others. These observers can become upstanders, who are 
the force multiplier of threat management. Their participation in the process of promoting public safety 
is crucial to success. Climates of safety and respect encourage upstander action, and promoting such a 
climate is a worthy goal for organizations and communities alike. 


Threat management is intertwined with threat assessment—they are each part of a single 
discipline. One without the other may prove only partially effective at reducing or preventing targeted 
violence. Holistic assessment of the person is the key to a good assessment and therefore effective in 
devising management strategies. Not every strategy will work as intended, but thoughtful and well- 
reasoned prevention plans are generally effective in reducing violence. Risk factors, warning behaviors, 
stressors and precipitating events, and mitigators are all carefully considered. While it can be tempting 
to assign all blame for targeted violence on serious mental illness, the reality is that mental illness is one 
of a multitude of threat enhancing factors relevant to violence concern. Threat enhancing and 
mitigating factors can potentially be identified in nearly every aspect of a person’s life. This is why a 
multidisciplinary and collaborative process is the recommended method. 


Engaging a multidisciplinary team is perhaps the single most important thing a community or 
organization can do to further its prevention efforts. Professionals from various disciplines, working in 
concert, come together to apply a wide range of experience, expertise, and judgment to a problem that 
is complicated and often quite nuanced. While one discipline or another may at times take on a leading 
role in a case, generally speaking a good management plan draws its strength from multiple points of 
view and sources of expertise. A well-functioning team will recognize this and develop a practiced 
consultative process. 


Additionally, the importance of education and awareness regarding threat assessment and 
management efforts cannot be overstated. A concern cannot be mitigated unless the threat 
management team is made aware of the concern. Informing the community that threat management 
resources exist is just as important as having ateam. While setting up a team can seem daunting, it can 
be done. Cooperation, consultation, assumption of responsibility, and sharing of information are 
guiding principles for the establishment and functioning of a team. 
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Much has been proposed in recent years with regard to updates to laws and systems which 
impact targeted violence. Privacy, mental health, criminal and other laws, as well as rules and 
regulations, impact this work and potentially should be updated. Updates will require thoughtful and 
reasoned deliberation and debate, inclusion of many viewpoints, and a balancing of safety and privacy 
concerns for individuals. In the meantime, this guide may be helpful in outlining first steps or in 
advancing a program that is already underway. The BAU and the symposium participants recognize that 
this evolution is, understandably, not going to happen overnight. 


New and additional research is needed on measuring the success of threat management 
strategies, though this may be challenged by the difficulty with measuring success. How can research 
confirm that one specific management technique was the one that prevented violence, versus other 
techniques used in the same case? How can research validate at all that a team’s threat management 
plan, rather than the universe of other influences, prevented a person of concern from ever becoming 
violent? For each offender who demonstrated specific threat enhancers and mitigators before he acted, 
there likely are others with similar histories who will never act. Research should be pursued by those 
with access to sufficient information to enable them to evaluate outcomes in response to management 
techniques. Knowledge derived from research is and will remain a critical part of this discipline. 


In conclusion, there is much work to be done in understanding the best ways to prevent 
targeted violence. Unknowns remain. However, what has been discovered thus far can assist 
communities and organizations with identifying, assessing, and managing threats of planned violence 
while promoting public safety. 
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Appendix A Levels of Concern 


This Appendix is intended to serve as a generalized guide for assessing levels of concern. It includes 
some points to consider about threatening or menacing communications as well as persons of concern. 
Depending upon the situation, more or less context may exist to inform an assessment (such as an 
anonymous threat written on a wall versus a fully identified person of concern in a workplace setting), 
and therefore this appendix can be potentially helpful as a triage tool or a part of a full assessment. 


“Communications of concern” sections can be used to assess communications of concern sent from 
unknown authors, or where little to no information is available about a known author; this would not 
include private thoughts such as journals, password protected materials, or other material not intended 
to be delivered to a third party. If more information becomes known during the course of investigation, 
use may then be made of the “Person of Concern” sections. 


The points for consideration which are listed below are not intended to be an exhaustive list. Each case 
involves many pieces of information and assessors should consider the totality of facts and 
circumstances. No individual factor listed below should be determinative in arriving at a level of 
concern. Conversely, it is not necessary for each factor to be present in a case before assessors are able 
to assign the corresponding level of concern. 


Communication of Concern 


> A communication has been received or reported that causes some concern about potential for 
violence; it may be confusing, unrealistic, or make no allusions to violence at all. 

> A clear grievance may not be stated or implied. 

> The communication appears to be more venting about an issue than actually warning of future 
predatory violence. 

> The communication may reference, or may itself be an attempt to resolve, an issue peacefully. 

> The author may have not offered “bona fides” to establish credibility or viability of the threat. 

> The communication may reference information that is inaccurate about the target, suggesting a 


lack of inside knowledge. Rudimentary research may or may not be evident. Little energy may 
have been expended in creating or delivering the communication. 


> The language of the communication may suggest a lack of overall commitment to follow- 
through on a threat. 

> The threatened action may be unrealistic or improbable (e.g., “I will plant a nuclear bomb at 
work.”) 

> The language may appear designed to convince the recipient of its seriousness, rather than 


convey an actual intent (e.g., “This is no joke.”) 
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> The method of delivery may not be suggestive of a physical approach or high-risk behavior (e.g., 
an anonymous letter posted through the mail versus a letter hand-delivered to the target’s 
home during waking hours.) 


Persons of Concern 

> The person has come to the attention of threat assessors, either directly by his actions or by 
concerns reported from others. 

> Even though the individual may have made a threat, through his actions and language it might 
appear he is seeking a peaceful resolution of an issue. 

> If the person seems to have developed a grievance, it may not be to the level where violence 
appears justified in addressing it. 

> Acting out violently may not currently be an acceptable means for him to achieve justice; this 

may be influenced by moral codes, spiritual/religious beliefs, a fear of legal sanctions, or other 

reasons. 

There does not appear to be a pressing time imperative to achieve resolution. 

The threat or other behavior may serve as venting. 

The person may have evidenced few to no warning behaviors. 

The person may not have a significant number of risk factors. 


VVVV WV 


Circumstances may make it nearly impossible for the subject to carry out his threat (e.g., the 
person of concern is incarcerated, does not have a proxy willing to act violently on his behalf, 
and the target is outside the institution.) 

> Evaluation of the case leads to a conclusion that mitigators far outweigh enhancers. 


This level suggests that the concern for future violence is low. Additional data gathering may be 
desirable and monitoring for any changes in violence risk factors or warning behaviors may be 
appropriate. 


Communication of Concern 


> The communication may explain an understandable grievance and may suggest that violence is 
being considered as an option for redress. 

> The communication may suggest the person has gathered inside information about the target, 
beyond that which is generally or publicly known. 

> The communication may reference the person’s engagement in warning behaviors. 

> The communication may reference the existence of risk factors. 

> There may be no sense of urgency in the communication; the person may still be pursuing 


peaceful alternatives to resolving his grievance. If a deadline is given, it may allow time for the 
recipient to respond and satisfy the grievance. 
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> The communication may suggest ambivalence by the author; he may not have completely made 
up his mind whether violence is an acceptable resolution (e.g., “This will happen either Tuesday 
or maybe Wednesday.”) 

> Threat assessors may not have complete or accurate information that would guide the 
assessment towards one end of the continuum or the other. 


Persons of Concern 


> The person may have surpassed some of the low level of concern factors, or there is an absence 
of significant mitigating factors. 

> The person may have a grievance, and is more likely to be considering violence as an option and 
as a means to achieve justice. 

> The person may not have made a decision about whether to act out violently. 

> Others may be concerned about the person potentially acting out violently. 

> The person may exhibit a cluster of warning behaviors, potentially combining both expression 
and action. 

> The person may be engaged in the research and planning phase of a possible attack (e.g., 


information gathering and basic research pertaining to a target.) 

> The person may have an increased number of risk factors (e.g. acting out violently, a paranoid 
personality disorder, substance abuse, or instability in employment and relationships). At this 
point in time, these factors may or may not be appropriately managed by the person or those 
around him. 

> Stressors may be present or forthcoming in the person’s life that could be considered “wild 
cards;” their activation or exacerbation could move the person further toward violence. 
Oftentimes these stressors involve financial, employment, status, family, or relationship 
troubles. 

> There may be significant information lacking from the investigation about the person, the 
potential victim, the context of the threat, or other substantial aspects, which make pinpointing 
a level of concern difficult. Critical factors which could impact the assessment one way or 
another are missing. 


This level suggests that violence could possibly occur, although the situation is not urgent. Violence 
cannot be ruled out. Monitoring and additional actions are necessary or desirable to further evaluate 
and respond to the situation to a point of resolution. 


Communication of Concern 

> The communication may reflect an increase in intensity and/or severity in the tone and 
content—particularly in a series of communications, as well as the person’s use of multiple 
methods of delivery (e.g., in-person, telephone, fax, mail, electronic, etc.). 
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> The communication may indicate the person has conducted research on the target and has 
necessary inside, personal, or background information on potential victim(s). It strongly 
suggests he has the knowledge necessary to approach and attack. 


> The communication may invoke special authority for violent action (e.g., divine sanction). 

> The communication may be directed and fixated on a cause or a person. 

> In a series of communications, in which the person has not acted, the most recent one may 
notably evidence a dramatic change in tone. 

> The communication may reference a time imperative and/or suggest the person is losing 
patience. 


Persons of Concern 

> The person of concern may have surpassed all criteria for the low and moderate designations 
and now appears to have begun preparing for a violent act. 

> Such preparations may include: weapons acquisition and training that are both contextually 
inappropriate and an escalation from his norm; evidence suggestive of time and energy- 
consuming research, such as surveillance; and/or suspicious probes or approaches to the target 


location. 

> Increasing warning behaviors may become more evident. 

> The person of concern may desire recognition and fame and believe that violence can help him 
achieve this. 

> Stressors in the person’s life appear to be escalating and his abilities to cope with them appear 
diminished. 

> Suicidal/homicidal ideation is likely to be present. 


This elevated level of concern suggests the person of concern is reaching a critical point on a pathway to 
violence from which he perceives it may be difficult to turn back. A threat management team and 
additional resources should focus on reducing his susceptibility to violence and the target’s vulnerability, 
through guidance and enhanced security efforts. 


Level of Concern: High 


Communication of Concern 


> The language appears less emotionally-driven and more action-oriented, suggesting that the 
person is operating in a predatory, as opposed to an emotional, reactive, or impulsive, mode. 

> There is a terminal theme to the communication, as if the relationship between the 
communicator and his victim will soon be over. 

> It may convey that action may be taken to end the grievance and achieve resolution. 

> The communication may convey the person has the means and ability to carry out the threat. 

> It conveys the person’s willingness to accept all negative consequences resulting from violence, 


and/or that the person may feel violence is the only available method of achieving justice. 
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> Highly concerning communications do not generally name the precise time, place, or target in 
advance. 


Persons of Concern 


> The person may have virtually or actually rehearsed the attack as a means to ensure he has both 
the ability and the internal mettle to commit violence. 

> The person has finalized his planning and preparation for a viable attack. 

> The person may have attempted to breach the target’s security through overt or surreptitious 
approach. 

> The person has exhibited highly concerning warning behaviors. 

> The person may exhibit a combination of serious mental illness, substance abuse or 
dependence, a history of violence or family of origin violence exposure, and/or other risk 
factors. 

> The person has the means and ability to carry out a violent attack. 

> The person appears willing to accept all negative consequences resulting from his violence. 

> Violence appears to be the only avenue of achieving justice currently available. 


This level suggests that violence is possible and could occur within the near future following any 
precipitating events. Immediate and continuing attention is required from threat management 
resources to ensure violence does not occur. 


Indications of Potential Imminence 


Imminence refers to a time period potentially including hours to weeks prior to a violent incident. The 
actual time of an incident cannot be predicted. When indicia of imminence are observed, a law 
enforcement response is warranted to disrupt behaviors that may be leading to violence. 


Communication of Concern 

> The communication suggests that all inhibitors to violence may be evaporating; circumstances in 
the person’s life may be rapidly changing so as to force the action; a time or violent action 
imperative is presented. 

> The communication suggests the person perceives his window of opportunity for an attack to be 
rapidly closing due to any number of circumstances, stressors, or precipitating events. 

> The communication itself indicates that a breach or attack has begun or been completed; may 
contemplate that the author has already died; appears intended to claim credit for an attack, 
attempt to provide rationale for an attack, or establish a legacy. 


Persons of Concern 

> Some warning behaviors demonstrated by a person of high concern could be associated with 
possible imminence, such as energy burst behaviors, last resort behaviors, end of life planning, 
sudden cessation of medications or other substance use, and sudden withdrawal from life 
pattern. Examples of each may be: 

o Energy Burst: Preparing equipment, conducting spot checks of a target location, buying 
needed supplies, and/or repeated posting online. 

o Last Resort: Posting a YouTube video called “The Day of Reckoning,” laying out how a 
person of concern is being tortured by the government (because he did not receive 
financial compensation for an imagined slight), cannot continue living with that insult, 
and offering the government one last chance. 

End of Life Planning: Creating a will or giving away possessions. 
Cessation of Medications or Substance Use: Suddenly stopping prescription 
psychoactive medication where normal pattern is taking the drug. 

o Withdrawal from Life Pattern: Failing to keep normal appointments or commitments 
and withdrawing to a position of enhanced privacy. 

> The person may be attempting to establish a legacy by claiming credit or attempting to provide 
a rationale for a violent act; communicating that a breach or attack has begun; and/or 
contemplating his own death during an assault. 

> The person has initiated a violent incident plan by beginning his travel/approach to the target. 


This level indicates that violence is likely to occur within hours or weeks and all efforts should focus on 
locating, containing, and neutralizing the threat of violence. 
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Appendix B Tripwires and Warning Signs 


Many offenders who engage in targeted violence may display certain behaviors during pre- 
attack planning. This appendix summarizes some which may indicate increasing concern. This list is not 
necessarily exhaustive, and other behaviors of concern may be evident. These behaviors may be 
observable to persons familiar with the person of concern and assessors should bear these in mind 
during encounters with him. No one behavior, standing alone, should be considered dispositive of 
violence concern; rather, all behaviors and circumstances should always be considered in totality. Some 
of these behaviors may include: 


> Statements or behaviors which seem to indicate suicidality, end of life planning, or an interest in 
destructiveness toward the world at large. 

> Signs of research, planning, and preparation which are contextually inappropriate in the person 
of concern’s everyday life. 

> Recent acquisition of weapons, ammunition, personal protective gear, tactical clothing, or other 
items, which is a departure from the individual’s normal patterns; recent escalation in target 
practice and weapons training may also be a concern if he previously owned weapons and 
ammunition. 

> Recent interest in explosive devices or acquisition of parts to construct one. 

> Contextually inappropriate, intense interest in or fascination with previous shooting incidents or 
mass assaults. This may include identification with perpetrators of violence, particularly mass 
violence, and such identifications may be with either fictional or nonfictional persons. 

> Drastic changes in appearance such as a shaved head, a large or multiple tattoos, contextually 
inappropriate law enforcement or military costuming, sudden weight loss or gain, cessation of 
hygiene, or sudden unkempt appearance. 


> Sudden withdrawal from life pattern, such as retreating to temporary quarters, absence from 
work without explanation, or failing to appear for appointments that are normally kept. 

> Sudden cessation of medications or other substance use. 

> Sudden onset of reckless sexual, financial, or other behaviors that may suggest a lack of concern 
for future consequences. 

> Preparation of “statement” or farewell writings, to include manifestos, videos, notes, internet 
blogs, or emails. 

> Recent and significant personal loss or humiliation, whether real or simply perceived, such as a 
death; breakup or divorce; or loss of a job, status, or self-image. 

> Recent acts of novel or experimental aggression including trespass, animal cruelty, or vandalism. 

> Any effort to physically approach an apparent target or close associates, evidence of items left 


for the target to find even if they appear benign (such as flowers), evidence of surveillance 
without approach, or attempts to breach or circumvent security measures. 

> Direct or indirect communications or threats using multiple methods of delivery, such as email, 
facsimile, hand-delivery, text-message, etc., escalating in frequency or intensity, or which 
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demonstrate that actual surveillance has occurred (e.g., “She looked frustrated when she left 
the Coffee Shop 1 in her grey coat at 6:23 a.m. today.”). 

Sudden change in social media behavior, including but not necessarily limited to use of 
encryption, decrease in postings, increase in postings, leakage, or novel use of different 
platforms. 
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Appendix C Threat Assessment and Management Process. 


~~ 


Concern Reported Triage Assess | Manage 
ePerson «Validity Results of Inquiry #Protect 
Communication eUrgency eThreat Enhancers eDevelop Strategies 
eAssemble Team eThreat Mitigators Monitor 
eProtective Reassess 
Measures 
elnvestigative Steps 


Triage Assess Manage 
Concern Reported QO) Does the referral have validity in Q The results of inquiry are QO) Take steps as needed to 
Q Does it involve a person of terms of raising concern for assembled to facilitate analysis. protect persons and 
concern or a communication by violence? Q The threat enhancers are property from violence. 
an unknown author? Q What level of urgency is needed identified and thoroughly Q Develop strategies to be 
for the threat assessment team discussed. implemented throughout 
response? Q The threat mitigators are management process (e.g., 

OQ What expertise is needed to identified and thoroughly treatment, discipline, 
assemble a team? discussed. detention). 

OQ) Whatimmediate protective Q_ Further monitor for 
measures should be behavioral changes which 
implemented? indicate escalation or 

Q What investigative steps are improvement. 
needed to ensure sufficient Q Continually reassess the 
information is gathered to person or situation to 
enable a thorough assessment? determine the accuracy of 

the assessment and 
effectiveness of 
managementstrategies. 


This process is cyclical until 
case retirement. 
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Appendix D Tarasoff/Duty to Warn and Duty to Protect 


Generally speaking, privacy and privilege end where danger to the public begins. Things said by 
persons of concern to mental health professionals evaluating or treating them are typically protected by 
federal and state laws covering doctor/patient privilege, and by practitioners’ ethics rules governing 
confidentiality. One exception to these principles—the duty to warn—arises from an effort to protect 
potential victims from a patient’s violent behavior. This exception is rooted in a pair of California state 
court decisions from the mid-1970s following the death of Tatiana Tarasoff.*? A graduate student who 
was infatuated with her told his therapist, before he murdered her, that he wanted to get a gun and kill 
her. The therapist had told campus police, but neither the police nor the therapist had warned Tatiana. 
In Tarasoff |, the California Supreme Court established a “duty to warn” rule; that is, mental health 
practitioners in California have a duty to warn third parties about potential violence if the victim is 
identifiable and the mental health professional knows or should have known that violence would occur. 
In Tarasoff II, the court created an additional “duty to protect;” that is, a mental health professional in 
California must use reasonable care to protect the potential victim of client violence when that provider 
determines that the client will harm an identifiable victim.®? In 2004, the California court further 
expanded the Tarasoff duties to situations in which a therapist learns of a threat from a patient or a 
family member, which leads the therapist to believe that patient poses a risk of grave bodily injury to 
another person.?? 


These duties to warn and protect have been expanded to other jurisdictions outside California. 
There are no blanket federal duties to warn or protect, and states’ laws vary in both form and function. 
Some states codify these duties in their legislative statutes, while in other states the duties arise out of 
judicial opinions or “common law.” Some states create mandatory duties to warn and protect, while 
others merely permit a breach of confidentiality in the therapeutic relationship if a threat is present. A 
minority of states offer neither case law nor statutory guidance on the duties to warn and protect.” 
Thus, it is critical for threat assessment team members to know the law—or absence of legal guidance— 
in their respective jurisdictions’, and to know the standard of care in their respective professions. Threat 
assessment teams should engage their legal counsel, including, but not limited to, local prosecutors, 
county attorneys, and state attorneys general, and seek guidance, clarity, and training on these legal 
issues. 


All threat assessment team members should be aware of the Tarasoff duties to warn and 
protect in their respective jurisdictions, as this knowledge can become a tool to persuade mental health 
providers to provide critical feedback during high-risk cases when the person of concern is in 
treatment.°> When faced with a situation that may trigger a duty to protect, mental health providers 
are encouraged to discuss the case with their colleagues. These situations are often nuanced and 
problematic to resolve, and present difficult questions such as whether a client has a violent fantasy 


fA table of state laws can be found on the National Conference of State Legislatures website: 
http://www.ncsl.org/research/health/mental-health-professionals-duty-to-warn.aspx. 
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versus a plan to harm another person.” Practitioners should consider directly questioning the person of 
concern regarding his violent behavior, thoughts, and feelings.°” When deciding whether to breach 
confidentiality in order to protect others, providers should not rely upon the person of concern’s words 
alone. (See discussion of the distinction of making a threat versus posing a threat, on page 15.) Rather, 
mental health professionals are encouraged to consider such factors as the person’s past history of 
violent and dangerous acts, personality characteristics, cognitive style and functioning, social history, 
history of criminal acts, current perceived stress, the nature of the social environment, means to 
accomplish violence, access to a victim, substance abuse, presence of anger, diagnosis, current level of 
functioning, and prior responses to treatment.®® It is equally important for the treating mental health 
providers to consider the risk presented by precipitating events such as rejection or some type of loss,” 
and other warning behaviors, discussed in this publication. 
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Appendix E Glossary of Terms 


Behavioral Threat Assessment 


Threat assessment is a systematic, fact-based method of investigation and examination that blends the 
collection and analysis of multiple sources of information with published research and practitioner 
experience, focusing on an individual’s patterns of thinking and behavior to determine whether, and to 
what extent, a person of concern is moving toward an attack. 


Brittle Person 


A psychologically brittle person seems unable to process the slights, rejections, teasing, and bullying that 
everyone experiences at some point in their lives. To a brittle person lacking adequate internal 
resources to help him appropriately process and cope, even a minor loss can be absolutely devastating. 


Confirmation Bias 


The tendency to look for evidence or interpret information in a way that confirms a preconceived 
opinion. 


Directly Communicated Threat 


An unambiguously stated or written threat to either a target or to law enforcement expressing intent to 
commit violence. 


Duty to Warn/Protect 


A legal duty of a mental health professional with knowledge of a potential act of violence by someone in 
his care, directed at a third party. This knowledge requires him to act reasonably to protect the 
potential victim from the threat. 


Energy Burst 


An increase in frequency, duration, or variety of warning behaviors related to a target, even if the 
behaviors themselves appear relatively innocuous, usually in the days or weeks before an attack. 


FERPA 


Acronym for Family Education Rights and Privacy Act. This law governs the gathering, maintenance, and 
accessibility of educational records. 
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Fixation 


An extreme preoccupation with another person, an activity, or an idea. In threat assessment and 
management cases, it is often observed to involve a grievance, personal cause, or a public figure. 


Grievance 


A cause of distress or reason for complaint/resentment; in threat assessment and management cases it 
includes a highly personal significance for the person of concern, often fueling a feeling of being 
wronged and generating behaviors related to a sense of mission, destiny, loss, or desire for revenge. 


HIPAA 


Acronym for Health Insurance Portability and Accountability Act. The HIPAA privacy rule governs 
protections for individuals’ health records and other identifiable health information. 


Impulsive/Reactive Violence 


Impulsive/reactive violence is emotional and impromptu; it can be a defensive behavior in response to a 
perceived imminent threat. 


Howlers 


Howlers are individuals who, though they may have engaged in inappropriate, bizarre, or threatening 
contact with the target, do not currently intend to commit violence. It is often difficult to discern a 
howler from someone who is planning violence, based on available case facts. 


Ideation 


Ideas specific to the utility and acceptability of violence as a means to address a person of concern’s 
particular grievance. 


Identification Behavior 


Actual or virtual behavior demonstrating a psychological desire to be a pseudo-commando, adopt a 
warrior mentality, identify with military or law enforcement paraphernalia, identify with past attackers, 
or to associate with advancing a particular cause or belief. 


Information Silos 


Information or knowledge that is kept separate, is tightly controlled, and not shared. When information 
about a threat or potentially threatening situation is not shared appropriately it can inhibit attempts to 
assess or manage it. 


Intimacy Effect 


The closer the interpersonal relationship between a person of concern and a target, the greater the 
likelihood is of violence. This intimacy can be based upon the person of concern’s perception of the 
relationship, including delusional perceptions. 


Last Resort Behavior 


Communications or actions indicating increasing desperation or distress, or that the person of concern 
perceives no alternatives to violence. 


Leakage 


Communications, expressions, or memorializations which do not directly threaten but otherwise reveal 
clues related to a person’s feelings, aspirations, intentions, or plans, about committing violence. 


Novel Aggression 


This is an act of violence which appears unrelated to any “pathway” behavior and which is committed 
for the first time. A person of concern may be engaging in this behavior in order to test his ability to 
actually engage in a violent act and it could be thought of as experimental aggression. 


Pathway to Violence 


One of several models proposed to describe a progression from grievance to attack. Steps along the 
pathway include a highly personalized grievance, violent ideation, research and planning, specific 
preparations for violence, breaches of security or other boundaries, and attack. It is possible that an 
individual’s personal pathway may differ or not exist at all. 


Predatory/Planned Violence 


Predatory/planned violence is premeditated and serves some purpose for those who plan and conduct 
violent attacks. The offender is not reacting to an imminent threat. 


Preparation 


Part of the pathway to violence model. After deciding on a course of action and conducting the 
necessary background work, a would-be offender may then begin to prepare for an actual attack. This 
step can overlap with research and planning. Behaviors associated with this can include acquiring 
weapons, assembling equipment, confirming transportation routes, rehearsing attack behaviors and 
more. 
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Pseudo-commando Identity 


A term that has been used to describe mass murderers who engage in planned attacks and are 
motivated by revenge fantasies. They are often heavily armed and may costume themselves in 
commando-style dress. 


Research and Planning 


Part of the pathway to violence model. This set of behaviors can include any thinking or information- 
seeking needed to form and refine a plan for engaging in an act of violence. This step can overlap with 
preparation. Behaviors associated with this step could include internet searches; watching news, social 
media or entertainment programming; conversing with like-minded others online; and more. 


Risk Assessment 


A calculation, based upon known variables, of a person’s risk for engaging in violence. Risk level is often 
based upon static factors rather than warning behaviors, and frequently requires in-person evaluations 
in a clinical setting. This technique is not commonly used by threat assessors. 


Target 


The general definition of a target is a person, thing, or place that is the focus of an attack. In threat 
assessment and management casework it is a point of fixation for intended violence. This can include 
people, buildings, organizations, or more general concepts. 


Targeted Violence 
An incident of violence where an assailant chooses a particular target prior to a violent attack. 
Threat Management 


Managing a person of concern’s behavior through interventions and strategies designed to disrupt or 
prevent an act of targeted violence. 


Threat Management Strategy 


A coordinated plan of direct and/or indirect interventions with a person of concern which, based on 
current information regarding level of concern posed, is designed to reduce the likelihood of violence 
concern in a given situation at a particular point in time. 


Threat Management Team 


A multidisciplinary team which coordinates with stakeholders and other third parties to identify, assess, 
and manage concerns for targeted violence. 
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Upstander 


An upstander is a bystander who reports what he knows or sees to law enforcement, human resources, 
school staffers, or a caring adult. An upstander can potentially intervene by various means, but most 
importantly by simply conveying what he knows, observes, or fears may happen. 


Violence Risk Assessment 


A specific tool designed to facilitate evaluation of a person of concern’s probability of committing an act 
of violence based on personal and situational variables. These tools are utilized by individuals qualified 
through training, experience, or education to make risk determinations. 
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